Who contributed to Node.js on July 22, 2026?

6 developers shipped this update, including Filip Skokan, Qard, trivikr, Mhayk Whandson, Matteo Collina, and Aviv Keller.

What were the notable Node.js updates?

crypto: preserve RSA-PSS legacy pubkey DER, src: avoid redundant KEM encapsulation copies, and src: avoid redundant KEM encapsulation copies.

@nodejs

The Node.js runtime — every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

NODE CORE HARDENS CRYPTO AND FFI, UNDICI PATCHES HEADER INJECTION

By RepoJournal · Filed 06:56 UTC on July 22, 2026 · About Node.js

6 people shipped this

Filip Skokan @panva 3 cited

Mhayk Whandson @mhayk 2 cited

Matteo Collina @mcollina 2 cited

Qard @Qard 1 cited

trivikr @trivikr 1 cited

Aviv Keller @avivkeller

Node's crypto layer just got faster and safer, while undici plugged a CRLF injection hole that only matters if your app trusts untrusted function objects as headers.

In brief

Node FFI now validates fast integer argument ranges. turns out letting C bindings accept arbitrary ints was a footgun waiting to happen.
Node crypto fixed RSA-PSS legacy pubkey DER preservation. small fix, but RSA-PSS interop is finicky enough that this matters.
undici patched header injection via CRLF in coerced values. validate everything, always. this one snuck past code review somewhere.
diagnostics_channel grew native channel storage in Node core. better instrumentation for folks shipping observability into their apps.

The crypto desk shipped three hardening commits that matter more than they sound. First, RSA-PSS key serialization now preserves historical DER formats without leaning on deprecated APIs [1], fixing a compatibility gap for legacy certificate chains. Second, KEM encapsulation [2] [3] eliminated redundant buffer copies by using a dedicated worker job, cutting allocations and improving throughput on post-quantum key exchange operations. Third, FFI fast calls [5] now validate integer argument ranges before hitting native trampolines, stopping silent truncation of i8/u8/i16/u16 values and BigInt wrapping that the slow path would have caught. On the undici front, two separate hardening fixes landed: setGlobalDispatcher [6] [8] now survives Object.freeze(globalThis), which security best practices explicitly recommend, by falling back to module-level storage when the global object isn't extensible. And header validation [7] [9] now checks coerced values for CRLF injection even when functions are passed as headers, closing a defense-in-depth gap. The diagnostics channel subsystem also got a growth fix [4], removing an arbitrary 1,024-channel limit that would hard-crash production systems.

Action items

→ Review your FFI integer usage if you're on the main branch; out-of-range values now throw instead of truncating nodejs/node [plan]
→ Update undici if you freeze globalThis in security-hardened applications nodejs/undici [plan]
→ Monitor diagnostics channel creation patterns if you're near 1,024 channels nodejs/node [monitor]

References

[1] crypto: preserve RSA-PSS legacy pubkey DER nodejs/node
[2] src: avoid redundant KEM encapsulation copies nodejs/node
[3] src: avoid redundant KEM encapsulation copies ↗ nodejs/node
[4] diagnostics_channel: grow native channel storage ↗ nodejs/node
[5] ffi: validate fast integer argument ranges ↗ nodejs/node
[6] fix: handle frozen globalThis in setGlobalDispatcher (#5574) nodejs/undici
[7] fix: validate coerced header values for CRLF (#5579) nodejs/undici
[8] fix: handle frozen globalThis in setGlobalDispatcher ↗ nodejs/undici
[9] fix: validate coerced header values for CRLF ↗ nodejs/undici

Quick answers

What shipped in Node.js on July 22, 2026?: Node's crypto layer just got faster and safer, while undici plugged a CRLF injection hole that only matters if your app trusts untrusted function objects as headers. In total, 15 commits and 11 pull requests landed.
Who contributed to Node.js on July 22, 2026?: 6 developers shipped this update, including Filip Skokan, Qard, trivikr, Mhayk Whandson, Matteo Collina, and Aviv Keller.
What were the notable Node.js updates?: crypto: preserve RSA-PSS legacy pubkey DER, src: avoid redundant KEM encapsulation copies, and src: avoid redundant KEM encapsulation copies.

NODE FIXES STACK OVERFLOW IN RECURSIVE READDIR, PATCHES PERMISSION AUDIT MODE

A circular symlink crash in recursive directory traversal just got patched, and permission audit mode finally stops throwing errors when it should only warn.

javascript 23 shipped 1-min read

@nodejs 2 days ago

NODE PLUGS TIMER MEMORY LEAK, FIXES FFI SIGNATURE DOUBLE-EVALUATION

Node's garbage collector was holding onto timer references it shouldn't have, and a critical FFI vulnerability let native functions receive different signatures than JavaScript thought it was passing.

javascript 18 shipped 1-min read

@nodejs 3 days ago

NODE FIXES CRITICAL STREAM PIPE BUG BLOCKING HEALTHY DESTINATIONS

A regression in Node's stream handling silences data flow to working destinations when a sibling pipe errors, breaking multi-destination pipelines across all recent versions.

javascript 13 shipped 1-min read

@nodejs 4 days ago

HTTP2 HEAP-USE-AFTER-FREE FIX LANDS IN NODE CORE

Node shipped a critical fix for a heap-use-after-free vulnerability in HTTP/2 stream handling that could crash servers under specific receive-and-send patterns.

javascript 20 shipped 1-min read

Elsewhere on the wire

@cachyos about 4 hours ago

PROTON 11.0 SHIPS WITH LOW-LATENCY VKD3D, MIRROR NETWORK EXPANDS

Proton 11.0 lands experimental low-latency graphics support while CachyOS adds a Hungary mirror to its distribution tier.

infra 45 shipped 1-min read

Elixir & Phoenix about 4 hours ago

ELIXIR TOOLING FIXES LAND AHEAD OF SYSTEM COMPATIBILITY PUSH

The compiler stops misinterpreting profile flags, string reversal handles invalid UTF8 correctly, and Ecto gains fragment column selection in a wave of fixes that shores up core library reliability.

elixir 11 shipped 1-min read

@dotnet about 4 hours ago

COMPLEX NUMBERS NOW IEEE 754 COMPLIANT, SKILLS EVALS GO VALLY-ONLY, UNSAFE EVOLVES

Complex<T> just shipped conformance to C23 Annex G special values, dotnet/skills completed its migration to the Vally eval harness, and the language is tightening unsafe semantics ahead of C# 13.

dotnet 141 shipped 2-min read

@spring-projects about 4 hours ago

SPRING BOOT TIGHTENS NULLABILITY CHECKS, FRAMEWORK CLEANS HOUSE

Spring Boot merged improvements to Nullaway 0.13.8 that correctly handle Map#remove nullability, while Spring Framework shipped targeted fixes for logging clarity and documentation.