Who contributed to Node.js on July 24, 2026?

6 developers shipped this update, including GitHub Actions, Tim Perry, Matteo Collina, trivikr, Shivam S, and Ulises Gascon.

What were the notable Node.js updates?

sqlite: fix use-after-free in Exec() and ApplyChangeset(), ffi: preserve strings during reentrant calls, and quic: defer server session emit until TLS ClientHello is processed.

Jul 24, 2026

$ the-wire · showcase

SQLITE GARBAGE COLLECTION BUG AND FFI REENTRANCY HAZARDS DEMAND IMMEDIATE PATCHES

By RepoJournal · Filed 06:56 UTC on July 24, 2026 · About Node.js · Composed from the cited sources · methodology

6 people shipped this

Matteo Collina @mcollina 3 cited

Tim Perry @pimterry 1 cited

trivikr @trivikr 1 cited

Shivam S @BIGSUS24 1 cited

Ulises Gascon @UlisesGascon 1 cited

GitHub Actions @web-flow

Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems.

The SQLite fix [1] addresses a catastrophic memory safety issue: when sqlite3_exec() or sqlite3changeset_apply() invoke JavaScript callbacks, the DatabaseSync object could be garbage-collected mid-call if user code dropped all references to it, leaving only a dangling C++ pointer. A BaseObjectPtr guard now keeps the database alive for the duration of the call. In parallel, the FFI layer shipped a reentrant call fix [2] that rewrites how temporary string buffers are cached. Previously, buffers were cached per library and argument index, so a reentrant callback making another FFI call at the same index would corrupt or overwrite storage still in use by the outer call. The fix scopes the cache by FFI wrapper and call depth, giving each reentrant invocation separate string storage. Both vulnerabilities are low-level crashes waiting to happen in production code that chains callbacks or uses FFI in event-driven patterns. On the QUIC front, Tim Perry's session emit deferral [3] ensures servers don't fire session events until after the TLS ClientHello is fully processed, preventing exposure to invalid handshakes and guaranteeing servername and alpnProtocol are available synchronously on the event. Undici hardened its cache directive parser [4] after a crash-on-parse issue was discovered with mixed qualified and unqualified private directives [5], and added content-length validation for blob bodies and partial content mismatches [6]. Documentation got a correction: dnsPromises.lookup's verbatim default was still listed as false in the docs despite flipping to true in v17 [7].

Action items

→ Review and test the SQLite fix [ref:3] if you use sync database operations with callbacks nodejs/node [immediate]
→ Test FFI code that makes reentrant calls or chains callbacks [ref:4] nodejs/node [immediate]
→ Update Undici and validate cache header parsing in your HTTP stack [ref:9] nodejs/undici [plan]

References

[1] sqlite: fix use-after-free in Exec() and ApplyChangeset() ↗ nodejs/node
[2] ffi: preserve strings during reentrant calls ↗ nodejs/node
[3] quic: defer server session emit until TLS ClientHello is processed ↗ nodejs/node
[4] fix(cache): harden cache directive parsing ↗ nodejs/undici
[5] test: cover crash on mixed unqualified and qualified private cache directives ↗ nodejs/undici
[6] fix(retry): reject partial content length mismatch ↗ nodejs/undici
[7] doc: fix dnsPromises.lookup verbatim default ↗ nodejs/node