Who contributed to Node.js on August 18, 2026?

5 developers shipped this update, including nodejs-github-bot, Trivikram Kamat, Seongeun Lee, flakey5, and dependabot.

What were the notable Node.js updates?

ffi: keep FFI functions non-constructible, ffi: remove dead null check in callback arguments, and src: fix accept-ranges header.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

NODE FFI HARDENS AGAINST CONSTRUCTOR ABUSE

By RepoJournal · Filed 06:56 UTC on August 18, 2026 · About Node.js

5 people shipped this

Trivikram Kamat @trivikr 2 cited

flakey5 @flakey5 2 cited

dependabot @dependabot 2 cited

nodejs-github-bot @nodejs-github-bot 1 cited

Seongeun Lee @leah-1ee

Node's FFI bindings just got safer, and a security release in the download pipeline demands your attention.

Two FFI fixes landed in nodejs/node: FFI functions are now non-constructible on all invocation paths [1], closing a loophole that could allow misuse via `new`. A dead null check was also removed, cleaning up callback argument handling [2]. Meanwhile, the release-cloudflare-worker fixed an accept-ranges header bug [3] and enabled KV directory listing for most paths in production [4], improving the performance of the Node.js download server. In undici, a security release for @fastify/busboy [5] addresses advisories including GHSA-xjh9-v7x6-24jw, which is likely relevant for anyone parsing multipart uploads. The googletest update [6] is routine, and the esbuild bump [7] fixes a TypeScript tree-shaking bug, so keep an eye on your bundle output. Activity across the four repos was light: 20 commits and 18 PRs, with no breaking changes in core Node.

Action items

→ Review FFI changes and update your Node fork if you use experimental FFI nodejs/node [plan]
→ Patch undici to the latest version that includes the @fastify/busboy security fix nodejs/undici [immediate]
→ Verify your multipart parsing isn't affected by the busboy advisory nodejs/undici [immediate]
→ Monitor esbuild 0.28.2 for any regressions in your build tooling nodejs/undici [monitor]

References

[1] ffi: keep FFI functions non-constructible ↗ nodejs/node
[2] ffi: remove dead null check in callback arguments nodejs/node
[3] src: fix accept-ranges header ↗ nodejs/release-cloudflare-worker
[4] src: enable kv directory listing for some dirs ↗ nodejs/release-cloudflare-worker
[5] build(deps-dev): bump @fastify/busboy from 3.2.0 to 3.2.1 ↗ nodejs/undici
[6] deps: update googletest to 49495eacfdbda3f4b6ba219923fedbb2e3f99376 ↗ nodejs/node
[7] build(deps-dev): bump esbuild from 0.28.1 to 0.28.2 ↗ nodejs/undici

Quick answers

What shipped in Node.js on August 18, 2026?: Node's FFI bindings just got safer, and a security release in the download pipeline demands your attention. In total, 20 commits and 18 pull requests landed.
Who contributed to Node.js on August 18, 2026?: 5 developers shipped this update, including nodejs-github-bot, Trivikram Kamat, Seongeun Lee, flakey5, and dependabot.
What were the notable Node.js updates?: ffi: keep FFI functions non-constructible, ffi: remove dead null check in callback arguments, and src: fix accept-ranges header.

Node slams the brakes on module.register

Node 26 makes module.register() a runtime deprecation, and citgm's test suite was the first to feel it.

javascript 28 shipped

@nodejs Aug 17

JS-YAML SECURITY FIX SHIPS IN NODEJS-DIST-INDEXER 1.8.24

The distribution indexer bumped js-yaml to 4.3.1, patching a quadratic complexity vulnerability in YAML omap duplicate key detection that could enable DoS attacks.

javascript 22 shipped

@nodejs Aug 16

WEBSTREAMS PROMISE CHURN CRUSHED, SQLITE DIAGNOSTICS LAND

Matteo Collina's twelfth round of pure-JS webstreams optimization cuts promise overhead by redesigning microtask handling on hot paths, while Node adds DatabaseSync diagnostic channels for production visibility.

javascript 29 shipped

@nodejs Aug 15

UNDICI FIXES ABORT HANDLING BUGS THAT HANG REQUESTS

Two critical fixes land in undici for abort signals that were silently ignored during retry backoff and request deduplication, leaving callers hanging indefinitely.

javascript 31 shipped

Elsewhere on the wire

AI Agents Aug 19

CLINE DESKTOP GOES NATIVE WITH BACKGROUND ALERTS

Cline's desktop app just became a tool you can leave running while you grab coffee, and LangChain is quietly fixing the token math that makes DeepSeek caching actually count.

ai-agents 97 shipped

@CachyOS Aug 19

CACHYOS PUSHES KERNEL 7.1.8 AND SCHEDULER FIXES ACROSS THE STACK

CachyOS is shipping a new kernel meanwhile patching its scheduler stack, and that combination is exactly what you want before your next deploy.

infra 58 shipped

Elixir & Phoenix Aug 19

LiveView memory leak fix leads overnight Elixir cleanup

A handful of pull requests across Elixir and Phoenix are quietly fixing leaks and edge cases that have been nagging at production apps.

elixir 19 shipped

@dotnet Aug 19

MAUI Overhauls NuGet Publishing as FSharp Preps for VS 18.11

MAUI is replacing its custom NuGet publishing with Microsoft's 1ES.PublishNuget, and FSharp is rolling Microsoft.Build deps forward to VS 18.11, two moves that reshape release engineering across the .NET ecosystem.