Who contributed to Node.js on July 22, 2026?

6 developers shipped this update, including Filip Skokan, Qard, trivikr, Mhayk Whandson, Matteo Collina, and Aviv Keller.

What were the notable Node.js updates?

crypto: preserve RSA-PSS legacy pubkey DER, src: avoid redundant KEM encapsulation copies, and src: avoid redundant KEM encapsulation copies.

Jul 22, 2026

$ the-wire · showcase

NODE CORE HARDENS CRYPTO AND FFI, UNDICI PATCHES HEADER INJECTION

By RepoJournal · Filed 06:56 UTC on July 22, 2026 · About Node.js · Composed from the cited sources · methodology

6 people shipped this

Filip Skokan @panva 3 cited

Mhayk Whandson @mhayk 2 cited

Matteo Collina @mcollina 2 cited

Qard @Qard 1 cited

trivikr @trivikr 1 cited

Aviv Keller @avivkeller

Node's crypto layer just got faster and safer, while undici plugged a CRLF injection hole that only matters if your app trusts untrusted function objects as headers.

In brief

Node FFI now validates fast integer argument ranges. turns out letting C bindings accept arbitrary ints was a footgun waiting to happen.
Node crypto fixed RSA-PSS legacy pubkey DER preservation. small fix, but RSA-PSS interop is finicky enough that this matters.
undici patched header injection via CRLF in coerced values. validate everything, always. this one snuck past code review somewhere.
diagnostics_channel grew native channel storage in Node core. better instrumentation for folks shipping observability into their apps.

The crypto desk shipped three hardening commits that matter more than they sound. First, RSA-PSS key serialization now preserves historical DER formats without leaning on deprecated APIs [1], fixing a compatibility gap for legacy certificate chains. Second, KEM encapsulation [2] [3] eliminated redundant buffer copies by using a dedicated worker job, cutting allocations and improving throughput on post-quantum key exchange operations. Third, FFI fast calls [5] now validate integer argument ranges before hitting native trampolines, stopping silent truncation of i8/u8/i16/u16 values and BigInt wrapping that the slow path would have caught. On the undici front, two separate hardening fixes landed: setGlobalDispatcher [6] [8] now survives Object.freeze(globalThis), which security best practices explicitly recommend, by falling back to module-level storage when the global object isn't extensible. And header validation [7] [9] now checks coerced values for CRLF injection even when functions are passed as headers, closing a defense-in-depth gap. The diagnostics channel subsystem also got a growth fix [4], removing an arbitrary 1,024-channel limit that would hard-crash production systems.

Action items

→ Review your FFI integer usage if you're on the main branch; out-of-range values now throw instead of truncating nodejs/node [plan]
→ Update undici if you freeze globalThis in security-hardened applications nodejs/undici [plan]
→ Monitor diagnostics channel creation patterns if you're near 1,024 channels nodejs/node [monitor]

References

[1] crypto: preserve RSA-PSS legacy pubkey DER ↗ nodejs/node
[2] src: avoid redundant KEM encapsulation copies ↗ nodejs/node
[3] src: avoid redundant KEM encapsulation copies ↗ nodejs/node
[4] diagnostics_channel: grow native channel storage ↗ nodejs/node
[5] ffi: validate fast integer argument ranges ↗ nodejs/node
[6] fix: handle frozen globalThis in setGlobalDispatcher (#5574) ↗ nodejs/undici
[7] fix: validate coerced header values for CRLF (#5579) ↗ nodejs/undici
[8] fix: handle frozen globalThis in setGlobalDispatcher ↗ nodejs/undici
[9] fix: validate coerced header values for CRLF ↗ nodejs/undici