Who contributed to Node.js on July 18, 2026?

6 developers shipped this update, including GitHub Actions, Eusgor, Jungwon Sohn, Donghoon Kang, pimterry, and Node.js GitHub Bot.

What were the notable Node.js updates?

http2: avoid uaf while receiving and sending rst_stream, doc: document TLS alpnProtocol and servername fields, and src: fix comment typos.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

HTTP2 HEAP-USE-AFTER-FREE FIX LANDS IN NODE CORE

By RepoJournal · Filed 06:56 UTC on July 18, 2026 · About Node.js

6 people shipped this

GitHub Actions @web-flow 1 cited

Eusgor @Eusgor 1 cited

Jungwon Sohn @sjungwon03 1 cited

Donghoon Kang @HoonDongKang 1 cited

pimterry @pimterry 1 cited

Node.js GitHub Bot @nodejs-github-bot

Node shipped a critical fix for a heap-use-after-free vulnerability in HTTP/2 stream handling that could crash servers under specific receive-and-send patterns.

The HTTP/2 team patched a nasty UAF in nghttp2_session_mem_recv() where RST_STREAM frames were being processed while nghttp2 was still iterating over streams [1]. The fix defers RST_STREAM handling until receive operations complete, preventing the session from closing streams that the underlying library is still touching. This is the kind of subtle memory safety issue that can stay dormant for years then explode under load. Beyond core, the team also landed documentation improvements covering TLS alpnProtocol and servername fields [2], finally giving these long-present properties the explicit coverage they deserved. Minor hygiene work continues across the codebase with comment and doc typo corrections [3] [4]. The nightly build pipeline remains active [5].

Action items

→ Pull the HTTP/2 UAF fix [ref:2] into your next release branch nodejs/node [immediate]
→ Review TLS alpnProtocol documentation updates [ref:6] if you expose these fields to users nodejs/node [plan]

References

[1] http2: avoid uaf while receiving and sending rst_stream ↗ nodejs/node
[2] doc: document TLS alpnProtocol and servername fields ↗ nodejs/node
[3] src: fix comment typos nodejs/node
[4] doc: fix typos in contributing docs nodejs/node
[5] snap: (auto) updated to 27.0.0-nightly20260718b8f81e9760 nodejs/snap

Quick answers

What shipped in Node.js on July 18, 2026?: Node shipped a critical fix for a heap-use-after-free vulnerability in HTTP/2 stream handling that could crash servers under specific receive-and-send patterns. In total, 12 commits and 8 pull requests landed.
Who contributed to Node.js on July 18, 2026?: 6 developers shipped this update, including GitHub Actions, Eusgor, Jungwon Sohn, Donghoon Kang, pimterry, and Node.js GitHub Bot.
What were the notable Node.js updates?: http2: avoid uaf while receiving and sending rst_stream, doc: document TLS alpnProtocol and servername fields, and src: fix comment typos.

Node DNS Reverse Lookups Fixed, REPL Gets Syntax Highlighting

Node core shipped a DNS fix that stops reverse lookups from consulting /etc/hosts, breaking alignment with documented behavior that caught developers mid-production.

javascript 14 shipped 1-min read

@nodejs 2 days ago

NODE CRASHES ON ODD-LENGTH HEX STRINGS VIA WRITEV

A critical crash in Node's binary handling when writing hex strings through Writev is now fixed, along with three other stability improvements shipping across the runtime.

javascript 25 shipped 1-min read

@nodejs 3 days ago

NODE CORE TIGHTENS DNS BEHAVIOR, DOCS TOOLING SHIFTS AWAY FROM OXC

DNS tests now codify a breaking change in record lookup behavior, while the documentation pipeline abandons OXC for a WASM-based alternative after CI runner incompatibility.

javascript 38 shipped 1-min read

@nodejs 4 days ago

SQLITE GARBAGE COLLECTION BUG AND FFI REENTRANCY HAZARDS DEMAND IMMEDIATE PATCHES

Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems.

javascript 42 shipped 2-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.

elixir 10 shipped 1-min read

Want every project, not just this one?

Follow @nodejs