Who contributed to Node.js on July 20, 2026?

7 developers shipped this update, including mcollina, Adrián Estrada, trivikr, panva, avivkeller, MFA-G, and Brian Muenzenmeyer.

What were the notable Node.js updates?

timers: do not retain a reference to the async store after firing, ffi: evaluate function signatures once, and cli: style node --help output with util.styleText.

@nodejs

The Node.js runtime — every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

NODE PLUGS TIMER MEMORY LEAK, FIXES FFI SIGNATURE DOUBLE-EVALUATION

By RepoJournal · Filed 06:56 UTC on July 20, 2026 · About Node.js

7 people shipped this

mcollina @mcollina 1 cited

Adrián Estrada @edsadr 1 cited

trivikr @trivikr 1 cited

panva @panva 1 cited

MFA-G @MFA-G 1 cited

avivkeller @avivkeller

Brian Muenzenmeyer @bmuenzenmeyer

Node's garbage collector was holding onto timer references it shouldn't have, and a critical FFI vulnerability let native functions receive different signatures than JavaScript thought it was passing.

The timer memory leak [1] is the bigger ship right now. After timers fire, Node was failing to clean up async context store references, preventing garbage collection. The fix iterates over active stores and clears relevant symbols, but the PR notes this pattern needs extending to immediates and intervals too. In parallel, the FFI signature double-evaluation bug [2] was letting attackers craft payloads where native code and the JavaScript wrapper disagreed on what arguments a function accepted. An accessor that mutates `signature.arguments` could make an eight-argument native function appear as fewer arguments to Node's type safety layer. Both merit immediate attention in your next patch cycle. On the surface improvements front, Node's shipping styled `--help` output [3] using util.styleText for bold headers and colored option names, though piped output stays plain. The doc-kit team is also hardening the deprecations table of contents [5], preserving DEP codes so engineers can find deprecations by ID instead of having them stripped from the sidebar.

Action items

→ Review PR #53443 for timer cleanup scope extension to immediates and intervals nodejs/node [immediate]
→ Audit FFI usage for accessor-based payload injection in PR #64559 nodejs/node [immediate]
→ Verify KangarooTwelve customization limits align with pending OpenSSL changes [ref:5] nodejs/node [plan]
→ Test styled --help output with piping and NO_COLOR env nodejs/node [monitor]

References

[1] timers: do not retain a reference to the async store after firing ↗ nodejs/node
[2] ffi: evaluate function signatures once ↗ nodejs/node
[3] cli: style node --help output with util.styleText nodejs/node
[4] crypto: limit KangarooTwelveParams customization to 512 bytes ↗ nodejs/node
[5] fix: preserve deprecation codes in table of contents ↗ nodejs/doc-kit

Quick answers

What shipped in Node.js on July 20, 2026?: Node's garbage collector was holding onto timer references it shouldn't have, and a critical FFI vulnerability let native functions receive different signatures than JavaScript thought it was passing. In total, 9 commits and 9 pull requests landed.
Who contributed to Node.js on July 20, 2026?: 7 developers shipped this update, including mcollina, Adrián Estrada, trivikr, panva, avivkeller, MFA-G, and Brian Muenzenmeyer.
What were the notable Node.js updates?: timers: do not retain a reference to the async store after firing, ffi: evaluate function signatures once, and cli: style node --help output with util.styleText.

NODE FIXES CRITICAL STREAM PIPE BUG BLOCKING HEALTHY DESTINATIONS

A regression in Node's stream handling silences data flow to working destinations when a sibling pipe errors, breaking multi-destination pipelines across all recent versions.

javascript 13 shipped 1-min read

@nodejs 3 days ago

HTTP2 HEAP-USE-AFTER-FREE FIX LANDS IN NODE CORE

Node shipped a critical fix for a heap-use-after-free vulnerability in HTTP/2 stream handling that could crash servers under specific receive-and-send patterns.

javascript 20 shipped 1-min read

@nodejs 4 days ago

NODE SITE BANNERS NOW DISMISSIBLE

The nodejs.org homepage got a close button, letting visitors dismiss the banner instead of living with it forever.

javascript 3 shipped 1-min read

@nodejs 5 days ago

NODE STREAM VALIDATION FIX LANDS, NIGHTLY BUILDS ROLL

Stream writer methods now properly validate options.signal before use, closing a gap where invalid signals caused inconsistent behavior across push, broadcast, and fromWritable.

javascript 25 shipped 1-min read

Elsewhere on the wire

@cachyos about 18 hours ago

LINUX 7.2-RC4 LANDS WITH GAMING SCHEDULER, ANANICY OVERHAULS PROCESS TUNING

CachyOS shipped kernel 7.2-rc4 with a new gaming-optimized scheduler branch and AMD display fixes, while ananicy-rules yanked normal scheduling from most process types in a major behavioral shift.

infra 56 shipped 1-min read

Elixir & Phoenix about 18 hours ago

ELIXIR COMPILER GETS 20% FASTER TYPE CHECKING

Multi-clause function analysis now runs significantly faster after the core team eliminated unnecessary list allocations in disjoint argument checking.

elixir 6 shipped 1-min read

@dotnet about 18 hours ago

MACIOS FIXES SYMBOL UPLOAD GAP, MSBUILD PULLS ARCADE UPDATES

Apple's App Store Connect will finally see proper crash symbolication for .NET iOS apps after macios shipped a fix that embeds symbol files directly in the .ipa.

dotnet 21 shipped 1-min read

FastAPI & Pydantic about 18 hours ago

PYDANTIC DOCS GET GRAMMAR CLEANUP

Pydantic merged a four-typo fix across docs and skill definitions that slipped past CI.

python 2 shipped 1-min read

Want every project, not just this one?

Follow @nodejs