Who contributed to Node.js on July 26, 2026?

7 developers shipped this update, including RajeshKumar11, Archkon, 3zrv, remcohaszing, avivkeller, vsolano9, and Node.js GitHub Bot.

What were the notable Node.js updates?

src: fix crash when writing odd-length hex string via Writev, crypto: use user-facing error for output encoding changes, and sqlite: keep database alive while a session is open.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

NODE CRASHES ON ODD-LENGTH HEX STRINGS VIA WRITEV

By RepoJournal · Filed 06:55 UTC on July 26, 2026 · About Node.js

7 people shipped this

RajeshKumar11 @RajeshKumar11 1 cited

Archkon @Archkon 1 cited

3zrv @3zrv 1 cited

remcohaszing @remcohaszing 1 cited

avivkeller @avivkeller

vsolano9 @vsolano9

Node.js GitHub Bot @nodejs-github-bot

A critical crash in Node's binary handling when writing hex strings through Writev is now fixed, along with three other stability improvements shipping across the runtime.

The most urgent fix addresses a fatal CHECK that crashed the process when hex-encoded strings with an odd number of characters were written through Writev, which is automatically triggered by HTTP request corking [1]. The same operation via single Write calls did not crash because StringBytes::Write delegates to HexDecode and silently drops the trailing incomplete nibble; the fix removes the CHECK and lets integer division handle odd lengths consistently. Alongside this, crypto error handling got a user-facing upgrade when output encoding changes between Cipher or Decipher calls [2], replacing internal assertions with proper ERR_INVALID_ARG_VALUE exceptions. A segmentation fault in the SQLite session handling has been sealed [3], preventing crashes when a database wasn't kept alive during an active session. ModuleHooks now implements Symbol.dispose as an alias for deregister [4], making registerHooks work with the using keyword for better resource cleanup patterns.

Action items

→ Pull the latest node/node commits if you use Writev or handle hex strings in production nodejs/node [immediate]
→ Review any crypto code using changing output encodings across Cipher/Decipher calls nodejs/node [plan]
→ Monitor nodejs.org CI changesets integration for documentation workflow impact nodejs/nodejs.org [monitor]

References

[1] src: fix crash when writing odd-length hex string via Writev nodejs/node
[2] crypto: use user-facing error for output encoding changes nodejs/node
[3] sqlite: keep database alive while a session is open ↗ nodejs/node
[4] module: implement Symbol.dispose in ModuleHooks ↗ nodejs/node

Quick answers

What shipped in Node.js on July 26, 2026?: A critical crash in Node's binary handling when writing hex strings through Writev is now fixed, along with three other stability improvements shipping across the runtime. In total, 13 commits and 12 pull requests landed.
Who contributed to Node.js on July 26, 2026?: 7 developers shipped this update, including RajeshKumar11, Archkon, 3zrv, remcohaszing, avivkeller, vsolano9, and Node.js GitHub Bot.
What were the notable Node.js updates?: src: fix crash when writing odd-length hex string via Writev, crypto: use user-facing error for output encoding changes, and sqlite: keep database alive while a session is open.

NODE CORE TIGHTENS DNS BEHAVIOR, DOCS TOOLING SHIFTS AWAY FROM OXC

DNS tests now codify a breaking change in record lookup behavior, while the documentation pipeline abandons OXC for a WASM-based alternative after CI runner incompatibility.

javascript 38 shipped 1-min read

@nodejs 2 days ago

SQLITE GARBAGE COLLECTION BUG AND FFI REENTRANCY HAZARDS DEMAND IMMEDIATE PATCHES

Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems.

javascript 42 shipped 2-min read

@nodejs 3 days ago

NODE.JS STRIPS DEPRECATED API CALLS, FIXES FFI BOOL REGRESSION

Antoine du Hamel landed two critical cleanups in core this cycle, removing deprecated function calls and custom DOM polyfills while the FFI layer gets a precision fix that restores uint8 semantics.

javascript 17 shipped 1-min read

@nodejs 4 days ago

NODE CORE HARDENS CRYPTO AND FFI, UNDICI PATCHES HEADER INJECTION

Node's crypto layer just got faster and safer, while undici plugged a CRLF injection hole that only matters if your app trusts untrusted function objects as headers.

javascript 26 shipped 1-min read

Elsewhere on the wire

AI Agents about 5 hours ago

OPENHANDS CUTS EVENT NOISE, CLINE SCRUBS DEAD CODE ACROSS TWO DESKS

OpenHands shipped a filter to stop forwarding unrequested automation events, while Cline burned down five legacy UI bugs in one sprint.

ai-agents 14 shipped 1-min read

Local LLMs about 5 hours ago

LLAMA.CPP LOCKS DOWN WASM, ADDS MCP STDIO, HEXAGON GETS IM2COL ACCELERATION

llama.cpp disabled OpenMP for Emscripten builds to fix WASM compilation, while shipping full MCP stdio support and unlocking 1.5x to 3.5x latency gains on Hexagon vision models.

llms 139 shipped 2-min read

@CachyOS about 5 hours ago

LINUX 7.1.5 AND 6.18.40 SHIP WITH UPSTREAM REBASES AND DRIVER FIXES

CachyOS dropped two kernel releases overnight, pulling in upstream stability patches and refining the apple-bce driver stack for T2 Macs.

infra 61 shipped 1-min read

Elixir & Phoenix about 5 hours ago

ELIXIR STRIPS REDUNDANT GUARDS, FIXES TUPLE PROJECTION BUG

Barna Kovacs landed three optimization PRs removing dead code from core Enum and Calendar modules, while a separate fix addresses a flawed tuple projection algorithm that was producing inconsistent type representations.