Who contributed to Node.js on June 28, 2026?

2 developers shipped this update, including trivikr and avivkeller.

What were the notable Node.js updates?

vfs: read RealFSProvider files from open fd, zlib: expose rejectGarbageAfterEnd option, and zlib: reject trailing gzip members in web streams.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

NODE VFS FIX STOPS SILENT FILE FAILURES ON RENAMED HANDLES

By RepoJournal · Filed 06:00 UTC on June 28, 2026 · About Node.js

2 people shipped this

trivikr @trivikr 1 cited

avivkeller @avivkeller 1 cited

A critical filesystem virtualization bug that caused ENOENT errors when tracked files were renamed after opening is now fixed.

The Virtual FileSystem layer in Node's file handling had a fundamental flaw: when you opened a file and then that file was renamed, subsequent reads through the open file descriptor would fail instead of following the inode like the real filesystem does [1]. The fix moves `RealFileHandle.readFileSync()` and `readFile()` to read through the already-open fd using positioned reads rather than reopening the original path, matching native behavior and preserving handle state [1]. In parallel, the zlib module is tightening its decompression security posture by exposing the previously internal `rejectGarbageAfterEnd` option [2] and applying it to web streams to reject trailing gzip members [3], addressing a class of parsing vulnerabilities. Crypto types are now officially documented [5], and the docs got a scrub to fix broken links and duplicate stability labels [4]. Doc-kit merged a feature to allow titles without markdown syntax [6], improving templating flexibility.

Action items

→ Test VFS-backed file operations if you use virtual filesystems or file tracking nodejs/node [plan]
→ Review zlib decompression streams for exposure to concatenated gzip members nodejs/node [monitor]
→ Update to latest Node when released to get the VFS handle fix nodejs/node [plan]

References

[1] vfs: read RealFSProvider files from open fd ↗ nodejs/node
[2] zlib: expose rejectGarbageAfterEnd option nodejs/node
[3] zlib: reject trailing gzip members in web streams nodejs/node
[4] doc: fix broken links and duplicate stability label nodejs/node
[5] typings: add typing for crypto nodejs/node
[6] feat(title): allow no-md title ↗ nodejs/doc-kit

Quick answers

What shipped in Node.js on June 28, 2026?: A critical filesystem virtualization bug that caused ENOENT errors when tracked files were renamed after opening is now fixed. In total, 8 commits and 4 pull requests landed.
Who contributed to Node.js on June 28, 2026?: 2 developers shipped this update, including trivikr and avivkeller.
What were the notable Node.js updates?: vfs: read RealFSProvider files from open fd, zlib: expose rejectGarbageAfterEnd option, and zlib: reject trailing gzip members in web streams.

Node DNS Reverse Lookups Fixed, REPL Gets Syntax Highlighting

Node core shipped a DNS fix that stops reverse lookups from consulting /etc/hosts, breaking alignment with documented behavior that caught developers mid-production.

javascript 14 shipped 1-min read

@nodejs 2 days ago

NODE CRASHES ON ODD-LENGTH HEX STRINGS VIA WRITEV

A critical crash in Node's binary handling when writing hex strings through Writev is now fixed, along with three other stability improvements shipping across the runtime.

javascript 25 shipped 1-min read

@nodejs 3 days ago

NODE CORE TIGHTENS DNS BEHAVIOR, DOCS TOOLING SHIFTS AWAY FROM OXC

DNS tests now codify a breaking change in record lookup behavior, while the documentation pipeline abandons OXC for a WASM-based alternative after CI runner incompatibility.

javascript 38 shipped 1-min read

@nodejs 4 days ago

SQLITE GARBAGE COLLECTION BUG AND FFI REENTRANCY HAZARDS DEMAND IMMEDIATE PATCHES

Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems.

javascript 42 shipped 2-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.