Who contributed to Node.js on July 24, 2026?

6 developers shipped this update, including GitHub Actions, Tim Perry, Matteo Collina, trivikr, Shivam S, and Ulises Gascon.

What were the notable Node.js updates?

sqlite: fix use-after-free in Exec() and ApplyChangeset(), ffi: preserve strings during reentrant calls, and quic: defer server session emit until TLS ClientHello is processed.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

SQLITE GARBAGE COLLECTION BUG AND FFI REENTRANCY HAZARDS DEMAND IMMEDIATE PATCHES

By RepoJournal · Filed 06:56 UTC on July 24, 2026 · About Node.js

6 people shipped this

Matteo Collina @mcollina 3 cited

Tim Perry @pimterry 1 cited

trivikr @trivikr 1 cited

Shivam S @BIGSUS24 1 cited

Ulises Gascon @UlisesGascon 1 cited

GitHub Actions @web-flow

Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems.

The SQLite fix [1] addresses a catastrophic memory safety issue: when sqlite3_exec() or sqlite3changeset_apply() invoke JavaScript callbacks, the DatabaseSync object could be garbage-collected mid-call if user code dropped all references to it, leaving only a dangling C++ pointer. A BaseObjectPtr guard now keeps the database alive for the duration of the call. In parallel, the FFI layer shipped a reentrant call fix [2] that rewrites how temporary string buffers are cached. Previously, buffers were cached per library and argument index, so a reentrant callback making another FFI call at the same index would corrupt or overwrite storage still in use by the outer call. The fix scopes the cache by FFI wrapper and call depth, giving each reentrant invocation separate string storage. Both vulnerabilities are low-level crashes waiting to happen in production code that chains callbacks or uses FFI in event-driven patterns. On the QUIC front, Tim Perry's session emit deferral [3] ensures servers don't fire session events until after the TLS ClientHello is fully processed, preventing exposure to invalid handshakes and guaranteeing servername and alpnProtocol are available synchronously on the event. Undici hardened its cache directive parser [4] after a crash-on-parse issue was discovered with mixed qualified and unqualified private directives [5], and added content-length validation for blob bodies and partial content mismatches [6]. Documentation got a correction: dnsPromises.lookup's verbatim default was still listed as false in the docs despite flipping to true in v17 [7].

Action items

→ Review and test the SQLite fix [ref:3] if you use sync database operations with callbacks nodejs/node [immediate]
→ Test FFI code that makes reentrant calls or chains callbacks [ref:4] nodejs/node [immediate]
→ Update Undici and validate cache header parsing in your HTTP stack [ref:9] nodejs/undici [plan]

References

[1] sqlite: fix use-after-free in Exec() and ApplyChangeset() nodejs/node
[2] ffi: preserve strings during reentrant calls ↗ nodejs/node
[3] quic: defer server session emit until TLS ClientHello is processed nodejs/node
[4] fix(cache): harden cache directive parsing nodejs/undici
[5] test: cover crash on mixed unqualified and qualified private cache directives nodejs/undici
[6] fix(retry): reject partial content length mismatch nodejs/undici
[7] doc: fix dnsPromises.lookup verbatim default nodejs/node

Quick answers

What shipped in Node.js on July 24, 2026?: Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems. In total, 27 commits and 15 pull requests landed.
Who contributed to Node.js on July 24, 2026?: 6 developers shipped this update, including GitHub Actions, Tim Perry, Matteo Collina, trivikr, Shivam S, and Ulises Gascon.
What were the notable Node.js updates?: sqlite: fix use-after-free in Exec() and ApplyChangeset(), ffi: preserve strings during reentrant calls, and quic: defer server session emit until TLS ClientHello is processed.

NODE.JS STRIPS DEPRECATED API CALLS, FIXES FFI BOOL REGRESSION

Antoine du Hamel landed two critical cleanups in core this cycle, removing deprecated function calls and custom DOM polyfills while the FFI layer gets a precision fix that restores uint8 semantics.

javascript 17 shipped 1-min read

@nodejs 2 days ago

NODE CORE HARDENS CRYPTO AND FFI, UNDICI PATCHES HEADER INJECTION

Node's crypto layer just got faster and safer, while undici plugged a CRLF injection hole that only matters if your app trusts untrusted function objects as headers.

javascript 26 shipped 1-min read

@nodejs 3 days ago

NODE FIXES STACK OVERFLOW IN RECURSIVE READDIR, PATCHES PERMISSION AUDIT MODE

A circular symlink crash in recursive directory traversal just got patched, and permission audit mode finally stops throwing errors when it should only warn.

javascript 23 shipped 1-min read

@nodejs 4 days ago

NODE PLUGS TIMER MEMORY LEAK, FIXES FFI SIGNATURE DOUBLE-EVALUATION

Node's garbage collector was holding onto timer references it shouldn't have, and a critical FFI vulnerability let native functions receive different signatures than JavaScript thought it was passing.

javascript 18 shipped 1-min read

Elsewhere on the wire

AI Agents about 1 hour ago

LANGCHAIN SHIPS COORDINATED PROVIDER UPDATES WITH LANGSMITH GATEWAY SUPPORT

All four core LangChain packages bumped to 1.5.1 overnight with unified LangSmith gateway routing and provider-specific fixes across OpenAI, Anthropic, and Fireworks.

ai-agents 62 shipped 1-min read

Local LLMs about 1 hour ago

LLAMA.CPP SHIPS FIVE RELEASES IN 24 HOURS, FIXES SPECULATIVE DECODING ACROSS THE STACK

The inference stack is consolidating around speculative decoding, and the bugs surfacing there are getting squashed across three major projects simultaneously.

llms 157 shipped 2-min read

@CachyOS about 1 hour ago

INSTALLER REFACTOR TAKES SHAPE, PACKAGE UPDATES ROLL STEADY

CachyOS is modernizing its CLI installer with a comprehensive typed partition system overhaul while maintaining smooth automation across the AUR-derived package repository.

infra 57 shipped 1-min read

Elixir & Phoenix about 1 hour ago

PHOENIX LIVE VIEW SEALS CRITICAL NODE NAME LEAK IN UPLOAD TOKENS

A reverted encryption fix exposes how Phoenix was leaking BEAM node identities through unencrypted upload tokens, and the core team is pivoting to a cleaner solution using term_to_binary.