Who contributed to Node.js on July 7, 2026?

4 developers shipped this update, including gurgunday, efekrskl, avivkeller, and KhafraDev.

What were the notable Node.js updates?

buffer: add fast api for isUtf8 and isAscii, buffer: remove unreachable overflow check in atob, and quic: drop version negotiation packets with oversized CIDs.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

BUFFER METHODS GET 15% SPEED BOOST, QUIC HARDENS AGAINST PACKET ATTACKS

By RepoJournal · Filed 06:01 UTC on July 7, 2026 · About Node.js

4 people shipped this

gurgunday @gurgunday 1 cited

efekrskl @efekrskl 1 cited

avivkeller @avivkeller 1 cited

KhafraDev @KhafraDev 1 cited

Node core shipped three performance wins overnight while tightening QUIC security for version negotiation packets.

The buffer desk landed a fast API implementation for isUtf8 and isAscii that cuts execution time by 14-16% [1], the kind of foundational speedup that compounds across the ecosystem. Core also removed dead code from atob's overflow check [2] and hardened QUIC to reject version negotiation packets with oversized connection IDs [3], closing an attack surface in the experimental QUIC implementation. The stream desk fixed half-open duplexes in async iteration [4], resolving a long-standing edge case where duplex streams weren't fully consumed. Over in undici, the fetch implementation now uses ReadableStreamTee for proper stream cloning [6], fixing a subtle but critical bug where cloned streams could fail under concurrent reads. Build tooling got a small win too: linting the man page no longer triggers on normal builds [5].

Action items

→ Upgrade to the next Node release when available to get buffer performance gains nodejs/node [plan]
→ Test half-open duplex streams in production workloads after next release nodejs/node [monitor]
→ Pull latest undici for fetch stream cloning fix if you clone request bodies nodejs/undici [plan]

References

[1] buffer: add fast api for isUtf8 and isAscii ↗ nodejs/node
[2] buffer: remove unreachable overflow check in atob nodejs/node
[3] quic: drop version negotiation packets with oversized CIDs nodejs/node
[4] stream: preserve half-open duplexes in async iteration ↗ nodejs/node
[5] build: allow linting node.1 ↗ nodejs/node
[6] fetch: use ReadableStreamTee for cloning streams ↗ nodejs/undici

Quick answers

What shipped in Node.js on July 7, 2026?: Node core shipped three performance wins overnight while tightening QUIC security for version negotiation packets. In total, 25 commits and 19 pull requests landed.
Who contributed to Node.js on July 7, 2026?: 4 developers shipped this update, including gurgunday, efekrskl, avivkeller, and KhafraDev.
What were the notable Node.js updates?: buffer: add fast api for isUtf8 and isAscii, buffer: remove unreachable overflow check in atob, and quic: drop version negotiation packets with oversized CIDs.

Node DNS Reverse Lookups Fixed, REPL Gets Syntax Highlighting

Node core shipped a DNS fix that stops reverse lookups from consulting /etc/hosts, breaking alignment with documented behavior that caught developers mid-production.

javascript 14 shipped 1-min read

@nodejs 2 days ago

NODE CRASHES ON ODD-LENGTH HEX STRINGS VIA WRITEV

A critical crash in Node's binary handling when writing hex strings through Writev is now fixed, along with three other stability improvements shipping across the runtime.

javascript 25 shipped 1-min read

@nodejs 3 days ago

NODE CORE TIGHTENS DNS BEHAVIOR, DOCS TOOLING SHIFTS AWAY FROM OXC

DNS tests now codify a breaking change in record lookup behavior, while the documentation pipeline abandons OXC for a WASM-based alternative after CI runner incompatibility.

javascript 38 shipped 1-min read

@nodejs 4 days ago

SQLITE GARBAGE COLLECTION BUG AND FFI REENTRANCY HAZARDS DEMAND IMMEDIATE PATCHES

Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems.

javascript 42 shipped 2-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.