Who contributed to Node.js on August 6, 2026?

10 developers shipped this update, including RafaelGSS, aduh95, Dario Piotrowicz, nodejs-github-bot, kyungrae2002, ostapondo, pacocartones, and mcollina, and 2 more.

What were the notable Node.js updates?

dns: handle large resolveAny address replies, 2026-08-05, Version 26.7.0 (Current), @aduh95, and doc: document ArrayBuffer support in pbkd2Sync.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

NODE 26.7.0 SHIPS WITH CRYPTO UPGRADES AND DNS SECURITY FIX

By RepoJournal · Filed 06:56 UTC on August 6, 2026 · About Node.js

10 people shipped this

mcollina @mcollina 2 cited

RafaelGSS @RafaelGSS 1 cited

aduh95 @aduh95 1 cited

kyungrae2002 @kyungrae2002 1 cited

pacocartones @pacocartones 1 cited

github-actions @github-actions 1 cited

Dario Piotrowicz @dario-piotrowicz

nodejs-github-bot @nodejs-github-bot

ostapondo @ostapondo

dependabot @dependabot

Node.js 26.7.0 landed overnight with SEMVER-MINOR crypto improvements and a critical DNS vulnerability patch that prevents large resolveAny replies from crashing.

The release [2] ships SEMVER-MINOR support for loading private keys through STORE loaders [2], alongside updated root certificates to NSS 3.125 [2]. More urgently, RafaelGSS patched a DNS handling vulnerability [1] that could cause crashes on large resolveAny address replies, tagged CVE-2026-58042 and signed off by Matteo Collina and Luigi Pinca. The crypto module also gained documented ArrayBuffer support in pbkdf2Sync [3], closing a documentation gap on stable functionality. Undici's mock subsystem got two critical fixes: preserving MockAgent interceptors when legacy global fetch calls setGlobalDispatcher [4], and re-invoking reply callbacks on persistent mocks that regressed in #5367 [5]. The nodejs.org blog post for 26.7.0 published automatically [6], and the Node.js team removed an unsigned vendor logo from the partners list [7] after confirming no agreement was in place.

Action items

→ Deploy Node 26.7.0 to production before next restart cycle - DNS vulnerability fix is critical nodejs/node [immediate]
→ If using Undici mocks in tests, verify MockAgent interceptors work with global fetch after this patch nodejs/undici [plan]
→ Review crypto.createPrivateKey documentation if loading keys from STORE in your stack nodejs/node [monitor]

References

[1] dns: handle large resolveAny address replies nodejs/node
[2] 2026-08-05, Version 26.7.0 (Current), @aduh95 ↗ nodejs/node
[3] doc: document ArrayBuffer support in pbkd2Sync nodejs/node
[4] fix: preserve MockAgent interceptors for legacy global fetch ↗ nodejs/undici
[5] fix(mock): re-invoke reply callback for persistent mocks ↗ nodejs/undici
[6] feat(blog): create post for v26.7.0 ↗ nodejs/nodejs.org
[7] chore: remove Codemod from partners list (#9084) nodejs/nodejs.org

Quick answers

What shipped in Node.js on August 6, 2026?: Node.js 26.7.0 landed overnight with SEMVER-MINOR crypto improvements and a critical DNS vulnerability patch that prevents large resolveAny replies from crashing. In total, 29 commits, 19 pull requests, and 1 releases landed.
Who contributed to Node.js on August 6, 2026?: 10 developers shipped this update, including RafaelGSS, aduh95, Dario Piotrowicz, nodejs-github-bot, kyungrae2002, ostapondo, pacocartones, and mcollina, and 2 more.
What were the notable Node.js updates?: dns: handle large resolveAny address replies, 2026-08-05, Version 26.7.0 (Current), @aduh95, and doc: document ArrayBuffer support in pbkd2Sync.

STREAMS SHED ALLOCATIONS, HTTP/2 WINDOWS QUADRUPLE

Node.js core cut per-chunk memory overhead in pipeTo by eliminating redundant promise allocations, while HTTP/2 default window sizes jumped 64x to unlock full bandwidth on high-latency connections.

javascript 70 shipped

@nodejs Aug 4

NODE 26.6.0 AND 24.19.0 LTS LAND WITH FFI EVENT LOOP AND BUFFER STREAMING

Node.js shipped two releases overnight: the current branch gets foreign function interface power, while the LTS line adds blob.textStream() and OpenSSL compression support.

javascript 73 shipped

@nodejs Aug 3

NODE CRYPTO UNLOCKS PRIVATE KEY LOADERS, FFI CRASH FIXED BEFORE IT SPREADS

Node core shipped two critical improvements overnight: crypto now loads private keys through OpenSSL STORE loaders, and FFI fast calls will no longer crash after library close.

javascript 63 shipped

@nodejs Aug 2

UNDICI FIXES SILENT INTERCEPTOR FAILURE; NODE ADDS ZIP SUPPORT AND HTTP DEPRECATION

Undici's cache() and deduplicate() interceptors were silently breaking on direct Client/Pool use, now fixed with fallback origin detection.

javascript 27 shipped

Elsewhere on the wire

AI Agents Aug 6

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.