Who contributed to Node.js on August 3, 2026?

5 developers shipped this update, including panva, nodejs-github-bot, trivikr, araujogui, and dependabot.

What were the notable Node.js updates?

crypto: support loading private keys through STORE loaders, deps: update zlib to 1.3.2.1-motley-42c2f19, and ffi: reject fast calls after library close.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

NODE CRYPTO UNLOCKS PRIVATE KEY LOADERS, FFI CRASH FIXED BEFORE IT SPREADS

By RepoJournal · Filed 06:56 UTC on August 3, 2026 · About Node.js

5 people shipped this

dependabot @dependabot 7 cited

nodejs-github-bot @nodejs-github-bot 2 cited

panva @panva 1 cited

trivikr @trivikr 1 cited

araujogui @araujogui 1 cited

Node core shipped two critical improvements overnight: crypto now loads private keys through OpenSSL STORE loaders, and FFI fast calls will no longer crash after library close.

The crypto module now supports loading private keys directly through WHATWG URL objects via configured OpenSSL STORE loaders [1], letting you pass `new URL('file:///path/to/private-key.pem')` straight into `createPrivateKey()` and downstream APIs like `sign()`, `privateDecrypt()`, and `decapsulate()`. This eliminates a friction point for workloads that manage keys through external stores. In parallel, a critical FFI fix [3] prevents optimized fast API calls from invoking stale symbol addresses after `DynamicLibrary.close()` unloads the library, which was causing SIGSEGV crashes on AArch64 and x64 SysV architectures. Root certificates updated to NSS 3.125 [5], dropping Entrust Root Certification Authority and SecureSign Root CA12. Separately, `Server.prototype._listen2` is now runtime-deprecated [4], signaling a coming removal. Zlib updated to 1.3.2.1-motley-42c2f19 [2]. The nodejs.org site absorbed routine dependency bumps: Storybook framework updates [6], testing tools [7], styling dependencies [8], and Vercel stack including Turbo 2.9.16 to 2.10.6 and Next.js ESLint plugin patches [9], plus wrangler 4.77.0 to 4.114.0 [10]. Doc-kit tooling advanced: c8 jumped to 12.0.0 [11] with stricter Node version enforcement, Playwright 1.62.0 [12] shipped a new component testing model, and CI actions refreshed including actions/setup-node 7.0.0 .

Action items

→ Review FFI fast call usage if you use crypto.sign() or privateDecrypt() with native libraries nodejs/node [immediate]
→ Migrate from Server._listen2 if your code calls this internal API nodejs/node [plan]
→ Update c8 to 12.0.0 if pinning Node ^20.19.0 || ^22.12.0 || >=23 nodejs/doc-kit [plan]

References

[1] crypto: support loading private keys through STORE loaders ↗ nodejs/node
[2] deps: update zlib to 1.3.2.1-motley-42c2f19 ↗ nodejs/node
[3] ffi: reject fast calls after library close ↗ nodejs/node
[4] net: runtime-deprecate Server.prototype._listen2 ↗ nodejs/node
[5] crypto: update root certificates to NSS 3.125 nodejs/node
[6] chore(deps): bump the storybook group across 1 directory with 3 updates ↗ nodejs/nodejs.org
[7] chore(deps): bump the testing group across 1 directory with 2 updates ↗ nodejs/nodejs.org
[8] chore(deps): bump the styling group across 1 directory with 2 updates ↗ nodejs/nodejs.org
[9] chore(deps): bump the vercel group across 1 directory with 7 updates ↗ nodejs/nodejs.org
[10] chore(deps): bump wrangler from 4.77.0 to 4.114.0 ↗ nodejs/nodejs.org
[11] meta: bump c8 from 11.0.0 to 12.0.0 ↗ nodejs/doc-kit
[12] meta: bump @playwright/test from 1.60.0 to 1.62.0 ↗ nodejs/doc-kit

Quick answers

What shipped in Node.js on August 3, 2026?: Node core shipped two critical improvements overnight: crypto now loads private keys through OpenSSL STORE loaders, and FFI fast calls will no longer crash after library close. In total, 20 commits and 43 pull requests landed.
Who contributed to Node.js on August 3, 2026?: 5 developers shipped this update, including panva, nodejs-github-bot, trivikr, araujogui, and dependabot.
What were the notable Node.js updates?: crypto: support loading private keys through STORE loaders, deps: update zlib to 1.3.2.1-motley-42c2f19, and ffi: reject fast calls after library close.

NODE 26.7.0 SHIPS WITH CRYPTO UPGRADES AND DNS SECURITY FIX

Node.js 26.7.0 landed overnight with SEMVER-MINOR crypto improvements and a critical DNS vulnerability patch that prevents large resolveAny replies from crashing.

javascript 49 shipped

@nodejs Aug 5

STREAMS SHED ALLOCATIONS, HTTP/2 WINDOWS QUADRUPLE

Node.js core cut per-chunk memory overhead in pipeTo by eliminating redundant promise allocations, while HTTP/2 default window sizes jumped 64x to unlock full bandwidth on high-latency connections.

javascript 70 shipped

@nodejs Aug 4

NODE 26.6.0 AND 24.19.0 LTS LAND WITH FFI EVENT LOOP AND BUFFER STREAMING

Node.js shipped two releases overnight: the current branch gets foreign function interface power, while the LTS line adds blob.textStream() and OpenSSL compression support.

javascript 73 shipped

@nodejs Aug 2

UNDICI FIXES SILENT INTERCEPTOR FAILURE; NODE ADDS ZIP SUPPORT AND HTTP DEPRECATION

Undici's cache() and deduplicate() interceptors were silently breaking on direct Client/Pool use, now fixed with fallback origin detection.

javascript 27 shipped

Elsewhere on the wire

AI Agents Aug 6

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.