RepoJournal
Node.js @nodejs
179 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-06-18
stories 53
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

NODE SHIPS FIVE SECURITY PATCHES OVERNIGHT, CLOSES CRITICAL TLS AND HTTP/2 HOLES

By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology

github-actions[bot] joecwu
2 people shipped this
github-actions[bot] @github-actions[bot] 3 cited joecwu @joecwu 1 cited

Five CVEs landed in the private repo with fixes for TLS hostname normalization, HTTP/2 memory exhaustion, SNI bypass, proxy credential leaks, and process.chdir permission handling - all merged and ready for release.

The security desk shipped a coordinated batch of fixes that close serious attack vectors in core protocols. A TLS hostname normalization bug [5] in server identity checks is patched alongside a case-sensitive SNI context matching vulnerability [8] that allowed mTLS bypass via uppercasing - both violations of RFC 6066. HTTP/2 clients now cap originSet at 128 entries to prevent unbounded memory growth from malicious servers [7]. Proxy credentials are redacted from tunnel errors [6] instead of leaking in stack traces, and process.chdir permission handling is hardened [4]. Meanwhile, the release desk published blog posts for three stable releases: v26.3.1 [1], v24.17.0 [2], and v22.23.0 [3]. On the undici front, two critical stream bugs landed: response chunks after stream destruction no longer crash with null reference errors [9], and multi-byte UTF-8 sequences in setEncoding() are now properly decoded [10] instead of corrupting CJK characters and emoji at chunk boundaries.

Action items

References

  1. [1] feat(blog): create post for v26.3.1 ↗ nodejs/nodejs.org
  2. [2] feat(blog): create post for v24.17.0 ↗ nodejs/nodejs.org
  3. [3] feat(blog): create post for v22.23.0 ↗ nodejs/nodejs.org
  4. [4] permission: handle process.chdir on writereport ↗ nodejs/node
  5. [5] tls: normalize hostname for server identity checks ↗ nodejs/node
  6. [6] lib,test: redact proxy credentials in tunnel errors ↗ nodejs/node
  7. [7] http2: cap originSet size to prevent unbounded memory growth ↗ nodejs/node
  8. [8] tls: fix case-sensitive SNI context matching ↗ nodejs/node
  9. [9] fix: drop response chunks after the response stream is destroyed (#5356) (#5357) ↗ nodejs/undici
  10. [10] fix: handle incomplete multi-byte UTF-8 sequences in setEncoding() ↗ nodejs/undici

$ ls nodejs/reviews/ # the step-back reads

the week in review commit-stream 3.0.0 restricts imports to package root the month in review Node 26 enters LTS as five undici advisories land
Full archive → Weekly reviews →

Quick answers

What shipped in Node.js on June 18, 2026?
Five CVEs landed in the private repo with fixes for TLS hostname normalization, HTTP/2 memory exhaustion, SNI bypass, proxy credential leaks, and process.chdir permission handling - all merged and ready for release. In total, 32 commits, 18 pull requests, and 3 releases landed.
Who contributed to Node.js on June 18, 2026?
2 developers shipped this update, including github-actions[bot] and joecwu.
What were the notable Node.js updates?
feat(blog): create post for v26.3.1, feat(blog): create post for v24.17.0, and feat(blog): create post for v22.23.0.
♥

$ log @nodejs --recent

Workers preload streams into the startup snapshot; http2 accepts repeated content-encoding 18 shipped HTTP drain stalls after coalesced chunks, undici restores h2 error codes 20 shipped Stale OpenSSL errors cleared, npm 12.2.2 lands in node 26 shipped Node coalesces duplicate DNS lookups, batches HTTP body spans 37 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.