RepoJournal
Node.js

@nodejs

The Node.js runtime — every backend team's CVE source of truth

Pick a date

  1. Fri 12 jun
  2. Sat 13 jun
  3. Sun 14 jun
  4. Mon 15 jun
  5. Tue 16 jun
  6. Wed 17 jun
  7. Thu 18 jun
  8. Fri 19 jun
  9. Sat 27 jun
  10. Sun 28 jun
  11. Mon 29 jun
  12. Tue 30 jun
  13. Wed 1 jul
  14. Thu 2 jul
  15. Fri 3 jul
  16. Sat 4 jul
  17. Sun 5 jul
  18. Mon 6 jul
  19. Tue 7 jul
  20. Wed 8 jul
  21. Thu 9 jul
  22. Fri 10 jul
  23. Sat 11 jul
  24. Sun 12 jul
  25. Mon 13 jul
  26. Tue 14 jul
  27. Wed 15 jul
  28. Thu 16 jul
  29. Fri 17 jul
  30. Today 18 jul
Topics: JavaScript Full archive →

The Wire · Showcase

HTTP2 HEAP-USE-AFTER-FREE FIX LANDS IN NODE CORE

By RepoJournal · Filed · About Node.js

GitHub Actions Eusgor Jungwon Sohn Donghoon Kang pimterry Node.js GitHub Bot
6 people shipped this
GitHub Actions @web-flow 1 cited Eusgor @Eusgor 1 cited Jungwon Sohn @sjungwon03 1 cited Donghoon Kang @HoonDongKang 1 cited pimterry @pimterry 1 cited Node.js GitHub Bot @nodejs-github-bot

Node shipped a critical fix for a heap-use-after-free vulnerability in HTTP/2 stream handling that could crash servers under specific receive-and-send patterns.

The HTTP/2 team patched a nasty UAF in nghttp2_session_mem_recv() where RST_STREAM frames were being processed while nghttp2 was still iterating over streams [1]. The fix defers RST_STREAM handling until receive operations complete, preventing the session from closing streams that the underlying library is still touching. This is the kind of subtle memory safety issue that can stay dormant for years then explode under load. Beyond core, the team also landed documentation improvements covering TLS alpnProtocol and servername fields [2], finally giving these long-present properties the explicit coverage they deserved. Minor hygiene work continues across the codebase with comment and doc typo corrections [3] [4]. The nightly build pipeline remains active [5].

Action items

References

  1. [1] http2: avoid uaf while receiving and sending rst_stream ↗ nodejs/node
  2. [2] doc: document TLS alpnProtocol and servername fields ↗ nodejs/node
  3. [3] src: fix comment typos nodejs/node
  4. [4] doc: fix typos in contributing docs nodejs/node
  5. [5] snap: (auto) updated to 27.0.0-nightly20260718b8f81e9760 nodejs/snap

Quick answers

What shipped in Node.js on July 18, 2026?
Node shipped a critical fix for a heap-use-after-free vulnerability in HTTP/2 stream handling that could crash servers under specific receive-and-send patterns. In total, 12 commits and 8 pull requests landed.
Who contributed to Node.js on July 18, 2026?
6 developers shipped this update, including GitHub Actions, Eusgor, Jungwon Sohn, Donghoon Kang, pimterry, and Node.js GitHub Bot.
What were the notable Node.js updates?
http2: avoid uaf while receiving and sending rst_stream, doc: document TLS alpnProtocol and servername fields, and src: fix comment typos.

More from @nodejs

Node.js @nodejs

NODE SITE BANNERS NOW DISMISSIBLE

The nodejs.org homepage got a close button, letting visitors dismiss the banner instead of living with it forever.

avivkeller Node.js GitHub Bot
javascript 3 shipped 1-min read
Node.js @nodejs

NODE STREAM VALIDATION FIX LANDS, NIGHTLY BUILDS ROLL

Stream writer methods now properly validate options.signal before use, closing a gap where invalid signals caused inconsistent behavior across push, broadcast, and fromWritable.

GitHub Actions trivikr Harjoth Khara 한만욱 +6
javascript 25 shipped 1-min read
Node.js @nodejs

NODE.JS RELIABILITY REPORT LOGGED FOR MID-2026

A reliability report has been added to the Node.js tracking system for July 15, 2026, though details remain sparse at this early stage.

Node.js GitHub Bot
javascript 1 shipped 1-min read
Node.js @nodejs

UNDICI FIXES H2 MULTIPLEXING BOTTLENECK, NODE EVENTS LAYER CUTS MEMORY BLOAT

Undici's HTTP/2 client can finally multiplex stream-bodied requests without waiting for other in-flight traffic to drain, fixing a critical performance regression that forced sequential request handling.

GiHoon1123 Ram Scott Taylor GitHub Actions +6
javascript 44 shipped 1-min read

Daily updates, in your inbox

Follow Node.js

The Node.js runtime — every backend team's CVE source of truth We'll email you a link to confirm first.

Free. Confirm via email. Unsubscribe in one click.

— or follow the whole beat:

Elsewhere on the wire

CachyOS @cachyos

PACKAGE UPDATES ROLL ACROSS AUR DERIVED AND PROTON CACHYOS

Claude Desktop jumped to 1.22209.0, Zen Browser patched to 1.21.8b, and documentation fixes landed across the stack overnight.

Pete Viri Piotr Gorski Matias Peter Jung +2
infra 43 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ELIXIR CUTS EXPONENTIAL GROWTH IN BDD INTERSECTIONS, PHOENIX LIVE VIEW SKIPS CLONES ON STABLE LISTS

The compiler just got smarter about preventing exponential blowup in type intersection logic, while Phoenix Live View stops wastefully copying keyed comprehensions that aren't moving.

José Valim Alexander Gubarev preciz SteffenDE
elixir 16 shipped 1-min read
.NET @dotnet

ASPNETCORE TIGHTENS AUTHORIZATION METADATA EVERYWHERE, BLAZOR DEBUGGING EXITS

Authorization policies now work consistently across all routing paths, not just endpoint middleware, while Blazor templates drop their deprecated WebAssembly debugging hook.

Javier Calvarro Nelson Copilot MayaKirova ilonatommy +4
dotnet 58 shipped 2-min read
Spring @spring-projects

SPRING FRAMEWORK TIGHTENS RESOURCE SECURITY, NEO4J FIXES CONVERSION LOGIC

Spring Framework reinstated critical resource location validation checks that prevent unauthorized static resource resolution in sensitive directories.

dependabot Brian Clozel ilgrosso
java 4 shipped 1-min read