RepoJournal
Node.js

@nodejs

The Node.js runtime — every backend team's CVE source of truth

What actually shipped in Node.js, written up every day — commits, pull requests, releases, and security advisories.

One email a day. Unsubscribe in one click.

Pick a date

  1. Mon 15 jun
  2. Tue 16 jun
  3. Wed 17 jun
  4. Thu 18 jun
  5. Fri 19 jun
  6. Sat 27 jun
  7. Sun 28 jun
  8. Mon 29 jun
  9. Tue 30 jun
  10. Wed 1 jul
  11. Thu 2 jul
  12. Fri 3 jul
  13. Sat 4 jul
  14. Sun 5 jul
  15. Mon 6 jul
  16. Tue 7 jul
  17. Wed 8 jul
  18. Thu 9 jul
  19. Fri 10 jul
  20. Sat 11 jul
  21. Sun 12 jul
  22. Mon 13 jul
  23. Tue 14 jul
  24. Wed 15 jul
  25. Thu 16 jul
  26. Fri 17 jul
  27. Sat 18 jul
  28. Sun 19 jul
  29. Mon 20 jul
  30. Today 21 jul
Topics: JavaScript Full archive →

The Wire · Showcase

NODE FIXES STACK OVERFLOW IN RECURSIVE READDIR, PATCHES PERMISSION AUDIT MODE

By RepoJournal · Filed · About Node.js

AkshatOP edsadr Trivikram Kamat panva YuSheng Chen github-actions[bot] dependabot
8 people shipped this
AkshatOP @AkshatOP 1 cited edsadr @edsadr 1 cited Trivikram Kamat @trivikr 1 cited panva @panva YuSheng Chen @samuel871211 github-actions[bot] @github-actions[bot] dependabot @dependabot semantic-release-bot @semantic-release-bot

A circular symlink crash in recursive directory traversal just got patched, and permission audit mode finally stops throwing errors when it should only warn.

Node shipped a critical fix for a denial-of-service vector in fs.readdirSync with recursive: true [1]. Circular symlinks would trigger unbounded recursion in the internal walk() helper, exhausting the call stack with RangeError and crashing the process. The existing symlink depth guard didn't protect this code path. Both sync and promise-based variants were vulnerable. In parallel, the permission system got a correctness fix: audit mode was still throwing ERR_ACCESS_DENIED on denied operations instead of just logging warnings [2]. The macros guarding fs, net, child_process, worker, and addon access now respect the warning_only() flag. On the streams side, share() had a buffering regression where the shared buffer could exceed its highWaterMark instead of applying backpressure [3]. These three fixes target real production pain: crashes from symlink traversal, broken audit workflows, and stream buffer overflow.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] vfs: prevent stack overflow in recursive readdir on circular symlinks ↗ nodejs/node
  2. [2] src,permission: do not throw on denied access in audit mode ↗ nodejs/node
  3. [3] stream: fix drop-newest behavior in share() nodejs/node

Quick answers

What shipped in Node.js on July 21, 2026?
A circular symlink crash in recursive directory traversal just got patched, and permission audit mode finally stops throwing errors when it should only warn. In total, 11 commits, 11 pull requests, and 1 releases landed.
Who contributed to Node.js on July 21, 2026?
8 developers shipped this update, including AkshatOP, edsadr, Trivikram Kamat, panva, YuSheng Chen, github-actions[bot], dependabot, and semantic-release-bot.
What were the notable Node.js updates?
vfs: prevent stack overflow in recursive readdir on circular symlinks, src,permission: do not throw on denied access in audit mode, and stream: fix drop-newest behavior in share().

More from @nodejs

Node.js @nodejs

NODE PLUGS TIMER MEMORY LEAK, FIXES FFI SIGNATURE DOUBLE-EVALUATION

Node's garbage collector was holding onto timer references it shouldn't have, and a critical FFI vulnerability let native functions receive different signatures than JavaScript thought it was passing.

mcollina Adrián Estrada trivikr panva +3
javascript 18 shipped 1-min read
Node.js @nodejs

NODE FIXES CRITICAL STREAM PIPE BUG BLOCKING HEALTHY DESTINATIONS

A regression in Node's stream handling silences data flow to working destinations when a sibling pipe errors, breaking multi-destination pipelines across all recent versions.

bmuenzenmeyer Mahin Anowar avivkeller Paul Bouchon +2
javascript 13 shipped 1-min read
Node.js @nodejs

HTTP2 HEAP-USE-AFTER-FREE FIX LANDS IN NODE CORE

Node shipped a critical fix for a heap-use-after-free vulnerability in HTTP/2 stream handling that could crash servers under specific receive-and-send patterns.

GitHub Actions Eusgor Jungwon Sohn Donghoon Kang +2
javascript 20 shipped 1-min read
Node.js @nodejs

NODE SITE BANNERS NOW DISMISSIBLE

The nodejs.org homepage got a close button, letting visitors dismiss the banner instead of living with it forever.

avivkeller Node.js GitHub Bot
javascript 3 shipped 1-min read

Daily updates, in your inbox

Follow Node.js

What actually shipped in Node.js, written up every day — commits, pull requests, releases, and security advisories.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

CachyOS @cachyos

NORWAY MIRROR DOWN, KERNEL STACK SHIPS MAINTENANCE RELEASES

CachyOS infrastructure is reporting a downed Norway mirror while the kernel and toolchain stacks push routine version bumps across the board.

Piotr Gorski Matias miwakasa ptr1337 +2
infra 55 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ECTO GAINS FRAGMENT COLUMN NAMING, PHOENIX PLUGS GET SMARTER

Ecto's new with_columns/2 lets you assign names to SQL fragments, while Phoenix now handles module plugs with options in pipe_through declarations.

José Valim AlexGx preciz Flo0807 +3
elixir 14 shipped 1-min read
Mobile platforms Mobile platforms

KOTLIN RIPS OUT INTERPRETER GUTS, FLUTTER PATCHES RENDERING PIPELINE

Kotlin is systematically removing its IR interpreter in a multi-commit cleanup that signals a major shift in how the compiler handles intermediate representation, while Flutter ships critical Vulkan safety fixes and expands autofill support.

Mohellebi Abdessalem jason-simmons Valentin Vignal jameskrupnik +7
mobile 115 shipped 2-min read
.NET @dotnet

MAUI 11 PREVIEW 6 SHIPS WITH 190 COMMITS, MACIOS FIXES GENERATOR FLAKINESS

.NET MAUI 11.0.0-preview.6 landed with significant platform improvements while dotnet/macios tackles a critical test parallelization bug that was silently dropping thread-safety calls from generated code.

kubaflo Shane Neuville rolfbjarne VincentBu +6
dotnet 59 shipped 2-min read
Want every project, not just this one?