RepoJournal
Node.js @nodejs
129 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-18
stories 20
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

HTTP2 HEAP-USE-AFTER-FREE FIX LANDS IN NODE CORE

By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology

GitHub Actions Eusgor Jungwon Sohn Donghoon Kang pimterry Node.js GitHub Bot
6 people shipped this
GitHub Actions @web-flow 1 cited Eusgor @Eusgor 1 cited Jungwon Sohn @sjungwon03 1 cited Donghoon Kang @HoonDongKang 1 cited pimterry @pimterry 1 cited Node.js GitHub Bot @nodejs-github-bot

Node shipped a critical fix for a heap-use-after-free vulnerability in HTTP/2 stream handling that could crash servers under specific receive-and-send patterns.

The HTTP/2 team patched a nasty UAF in nghttp2_session_mem_recv() where RST_STREAM frames were being processed while nghttp2 was still iterating over streams [1]. The fix defers RST_STREAM handling until receive operations complete, preventing the session from closing streams that the underlying library is still touching. This is the kind of subtle memory safety issue that can stay dormant for years then explode under load. Beyond core, the team also landed documentation improvements covering TLS alpnProtocol and servername fields [2], finally giving these long-present properties the explicit coverage they deserved. Minor hygiene work continues across the codebase with comment and doc typo corrections [3] [4]. The nightly build pipeline remains active [5].

$ ls nodejs/reviews/ # the step-back reads

the week in review Node 26.9.0 ships generic crypto MAC API the month in review Node 26 line lands crypto, stream, and FFI hardening as deprecations tighten the core
Topics: JavaScript Full archive → Weekly reviews →

Quick answers

What shipped in Node.js on July 18, 2026?
Node shipped a critical fix for a heap-use-after-free vulnerability in HTTP/2 stream handling that could crash servers under specific receive-and-send patterns. In total, 12 commits and 8 pull requests landed.
Who contributed to Node.js on July 18, 2026?
6 developers shipped this update, including GitHub Actions, Eusgor, Jungwon Sohn, Donghoon Kang, pimterry, and Node.js GitHub Bot.
What were the notable Node.js updates?
http2: avoid uaf while receiving and sending rst_stream, doc: document TLS alpnProtocol and servername fields, and src: fix comment typos.
♥

$ log @nodejs --recent

SEA gets ZIP asset archives, HTTP server sheds per-request allocations 28 shipped Buffer.stringLength(), and a trace_events abort for embedders 40 shipped cpSync dereference regression fixed, trace union punning removed 39 shipped Node 26.9.0 adds a generic MAC API, undici walks back its decompression size cap 27 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.