Who contributed to Node.js on August 18, 2026?

5 developers shipped this update, including nodejs-github-bot, Trivikram Kamat, Seongeun Lee, flakey5, and dependabot.

What were the notable Node.js updates?

ffi: keep FFI functions non-constructible, ffi: remove dead null check in callback arguments, and src: fix accept-ranges header.

Aug 18, 2026

$ the-wire · showcase

NODE FFI HARDENS AGAINST CONSTRUCTOR ABUSE

By RepoJournal · Filed 06:56 UTC on August 18, 2026 · About Node.js · Composed from the cited sources · methodology

5 people shipped this

Trivikram Kamat @trivikr 2 cited

flakey5 @flakey5 2 cited

dependabot @dependabot 2 cited

nodejs-github-bot @nodejs-github-bot 1 cited

Seongeun Lee @leah-1ee

Node's FFI bindings just got safer, and a security release in the download pipeline demands your attention.

Two FFI fixes landed in nodejs/node: FFI functions are now non-constructible on all invocation paths [1], closing a loophole that could allow misuse via `new`. A dead null check was also removed, cleaning up callback argument handling [2]. Meanwhile, the release-cloudflare-worker fixed an accept-ranges header bug [3] and enabled KV directory listing for most paths in production [4], improving the performance of the Node.js download server. In undici, a security release for @fastify/busboy [5] addresses advisories including GHSA-xjh9-v7x6-24jw, which is likely relevant for anyone parsing multipart uploads. The googletest update [6] is routine, and the esbuild bump [7] fixes a TypeScript tree-shaking bug, so keep an eye on your bundle output. Activity across the four repos was light: 20 commits and 18 PRs, with no breaking changes in core Node.

Action items

→ Review FFI changes and update your Node fork if you use experimental FFI nodejs/node [plan]
→ Patch undici to the latest version that includes the @fastify/busboy security fix nodejs/undici [immediate]
→ Verify your multipart parsing isn't affected by the busboy advisory nodejs/undici [immediate]
→ Monitor esbuild 0.28.2 for any regressions in your build tooling nodejs/undici [monitor]

References

[1] ffi: keep FFI functions non-constructible ↗ nodejs/node
[2] ffi: remove dead null check in callback arguments ↗ nodejs/node
[3] src: fix accept-ranges header ↗ nodejs/release-cloudflare-worker
[4] src: enable kv directory listing for some dirs ↗ nodejs/release-cloudflare-worker
[5] build(deps-dev): bump @fastify/busboy from 3.2.0 to 3.2.1 ↗ nodejs/undici
[6] deps: update googletest to 49495eacfdbda3f4b6ba219923fedbb2e3f99376 ↗ nodejs/node
[7] build(deps-dev): bump esbuild from 0.28.1 to 0.28.2 ↗ nodejs/undici