Who contributed to Node.js on August 4, 2026?

7 developers shipped this update, including nodejs-github-bot, Peter Dave Hello, dependabot, Rafael Gonzaga, aduh95, flakey5, and Aviv Keller.

What were the notable Node.js updates?

2026-08-03, Version 26.6.0 (Current), @aduh95, 2026-08-03, Version 24.19.0 'Krypton' (LTS), @aduh95, and deps: update minimatch to 10.2.6.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

NODE 26.6.0 AND 24.19.0 LTS LAND WITH FFI EVENT LOOP AND BUFFER STREAMING

By RepoJournal · Filed 06:56 UTC on August 4, 2026 · About Node.js

7 people shipped this

nodejs-github-bot @nodejs-github-bot 3 cited

aduh95 @aduh95 2 cited

dependabot @dependabot 1 cited

Rafael Gonzaga @RafaelGSS 1 cited

flakey5 @flakey5 1 cited

Aviv Keller @avivkeller 1 cited

Peter Dave Hello @PeterDaveHello

Node.js shipped two releases overnight: the current branch gets foreign function interface power, while the LTS line adds blob.textStream() and OpenSSL compression support.

Version 26.6.0 [1] adds getCurrentEventLoop to the FFI module, opening the door to deeper native integration, while 24.19.0 Krypton [2] lands buffer streaming and improved OpenSSL configuration on the long-term support track. Both releases roll forward with minimatch 10.2.6 [3] and simdjson 4.6.6 [4] dependencies locked in. The docker-node repo already tracks the LTS release [6] through automated tooling. Over on security, RafaelGSS joins the last stewards roster [7], marking a transition in the maintenance structure. One significant fix in undici 7.29.0 [5] patches a high-severity cache control directive issue that "malformed qualified private Cache-Control directives could cause cross-" origin violations, so watch for dependent projects to pull that down. The release-cloudflare-worker team reverted a staging subdomain change [9] after it landed [8], keeping DNS configuration stable for now.

Action items

→ Test 24.19.0 LTS against your current workloads, especially if you use OpenSSL compression nodejs/node [plan]
→ Bump undici to 7.29.0 if your project depends on it directly or via Node internals nodejs/docker-node [immediate]
→ Evaluate getCurrentEventLoop in FFI for your native bindings if you're on 26.6.0+ nodejs/node [monitor]

References

[1] 2026-08-03, Version 26.6.0 (Current), @aduh95 ↗ nodejs/node
[2] 2026-08-03, Version 24.19.0 'Krypton' (LTS), @aduh95 ↗ nodejs/node
[3] deps: update minimatch to 10.2.6 ↗ nodejs/node
[4] deps: update simdjson to 4.6.6 ↗ nodejs/node
[5] chore(deps-dev): bump undici from 7.28.0 to 7.29.0 ↗ nodejs/docker-node
[6] feat: Node.js 24.19.0 ↗ nodejs/docker-node
[7] doc: add RafaelGSS as last security release stewards nodejs/node
[8] Add subdomain for staging (#989) nodejs/release-cloudflare-worker
[9] Revert "Add subdomain for staging (#989)" (#995) nodejs/release-cloudflare-worker

Quick answers

What shipped in Node.js on August 4, 2026?: Node.js shipped two releases overnight: the current branch gets foreign function interface power, while the LTS line adds blob.textStream() and OpenSSL compression support. In total, 26 commits, 45 pull requests, and 2 releases landed.
Who contributed to Node.js on August 4, 2026?: 7 developers shipped this update, including nodejs-github-bot, Peter Dave Hello, dependabot, Rafael Gonzaga, aduh95, flakey5, and Aviv Keller.
What were the notable Node.js updates?: 2026-08-03, Version 26.6.0 (Current), @aduh95, 2026-08-03, Version 24.19.0 'Krypton' (LTS), @aduh95, and deps: update minimatch to 10.2.6.

NODE 26.7.0 SHIPS WITH CRYPTO UPGRADES AND DNS SECURITY FIX

Node.js 26.7.0 landed overnight with SEMVER-MINOR crypto improvements and a critical DNS vulnerability patch that prevents large resolveAny replies from crashing.

javascript 49 shipped

@nodejs Aug 5

STREAMS SHED ALLOCATIONS, HTTP/2 WINDOWS QUADRUPLE

Node.js core cut per-chunk memory overhead in pipeTo by eliminating redundant promise allocations, while HTTP/2 default window sizes jumped 64x to unlock full bandwidth on high-latency connections.

javascript 70 shipped

@nodejs Aug 3

NODE CRYPTO UNLOCKS PRIVATE KEY LOADERS, FFI CRASH FIXED BEFORE IT SPREADS

Node core shipped two critical improvements overnight: crypto now loads private keys through OpenSSL STORE loaders, and FFI fast calls will no longer crash after library close.

javascript 63 shipped

@nodejs Aug 2

UNDICI FIXES SILENT INTERCEPTOR FAILURE; NODE ADDS ZIP SUPPORT AND HTTP DEPRECATION

Undici's cache() and deduplicate() interceptors were silently breaking on direct Client/Pool use, now fixed with fallback origin detection.

javascript 27 shipped

Elsewhere on the wire

AI Agents Aug 6

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.