Who contributed to Node.js on June 18, 2026?

2 developers shipped this update, including github-actions[bot] and joecwu.

What were the notable Node.js updates?

feat(blog): create post for v26.3.1, feat(blog): create post for v24.17.0, and feat(blog): create post for v22.23.0.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

NODE SHIPS FIVE SECURITY PATCHES OVERNIGHT, CLOSES CRITICAL TLS AND HTTP/2 HOLES

By RepoJournal · Filed 06:01 UTC on June 18, 2026 · About Node.js

2 people shipped this

github-actions[bot] @github-actions[bot] 3 cited

joecwu @joecwu 1 cited

Five CVEs landed in the private repo with fixes for TLS hostname normalization, HTTP/2 memory exhaustion, SNI bypass, proxy credential leaks, and process.chdir permission handling - all merged and ready for release.

The security desk shipped a coordinated batch of fixes that close serious attack vectors in core protocols. A TLS hostname normalization bug [5] in server identity checks is patched alongside a case-sensitive SNI context matching vulnerability [8] that allowed mTLS bypass via uppercasing - both violations of RFC 6066. HTTP/2 clients now cap originSet at 128 entries to prevent unbounded memory growth from malicious servers [7]. Proxy credentials are redacted from tunnel errors [6] instead of leaking in stack traces, and process.chdir permission handling is hardened [4]. Meanwhile, the release desk published blog posts for three stable releases: v26.3.1 [1], v24.17.0 [2], and v22.23.0 [3]. On the undici front, two critical stream bugs landed: response chunks after stream destruction no longer crash with null reference errors [9], and multi-byte UTF-8 sequences in setEncoding() are now properly decoded [10] instead of corrupting CJK characters and emoji at chunk boundaries.

Action items

→ Review the five security patches immediately - all CVEs are in production scope nodejs/node [immediate]
→ Upgrade undici to pull in the stream destruction and UTF-8 decoding fixes before next release nodejs/undici [immediate]
→ Monitor the three stable releases for any build or deployment issues nodejs/nodejs.org [plan]

References

[1] feat(blog): create post for v26.3.1 ↗ nodejs/nodejs.org
[2] feat(blog): create post for v24.17.0 ↗ nodejs/nodejs.org
[3] feat(blog): create post for v22.23.0 ↗ nodejs/nodejs.org
[4] permission: handle process.chdir on writereport nodejs/node
[5] tls: normalize hostname for server identity checks nodejs/node
[6] lib,test: redact proxy credentials in tunnel errors nodejs/node
[7] http2: cap originSet size to prevent unbounded memory growth nodejs/node
[8] tls: fix case-sensitive SNI context matching nodejs/node
[9] fix: drop response chunks after the response stream is destroyed (#5356) (#5357) nodejs/undici
[10] fix: handle incomplete multi-byte UTF-8 sequences in setEncoding() ↗ nodejs/undici

Quick answers

What shipped in Node.js on June 18, 2026?: Five CVEs landed in the private repo with fixes for TLS hostname normalization, HTTP/2 memory exhaustion, SNI bypass, proxy credential leaks, and process.chdir permission handling - all merged and ready for release. In total, 32 commits, 18 pull requests, and 3 releases landed.
Who contributed to Node.js on June 18, 2026?: 2 developers shipped this update, including github-actions[bot] and joecwu.
What were the notable Node.js updates?: feat(blog): create post for v26.3.1, feat(blog): create post for v24.17.0, and feat(blog): create post for v22.23.0.

Node DNS Reverse Lookups Fixed, REPL Gets Syntax Highlighting

Node core shipped a DNS fix that stops reverse lookups from consulting /etc/hosts, breaking alignment with documented behavior that caught developers mid-production.

javascript 14 shipped 1-min read

@nodejs 2 days ago

NODE CRASHES ON ODD-LENGTH HEX STRINGS VIA WRITEV

A critical crash in Node's binary handling when writing hex strings through Writev is now fixed, along with three other stability improvements shipping across the runtime.

javascript 25 shipped 1-min read

@nodejs 3 days ago

NODE CORE TIGHTENS DNS BEHAVIOR, DOCS TOOLING SHIFTS AWAY FROM OXC

DNS tests now codify a breaking change in record lookup behavior, while the documentation pipeline abandons OXC for a WASM-based alternative after CI runner incompatibility.

javascript 38 shipped 1-min read

@nodejs 4 days ago

SQLITE GARBAGE COLLECTION BUG AND FFI REENTRANCY HAZARDS DEMAND IMMEDIATE PATCHES

Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems.

javascript 42 shipped 2-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.