RepoJournal
Node.js @nodejs
116 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-05
stories 73
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Node.js security patches land, permission audit mode fixes, and stream EOF optimization

By RepoJournal · Filed · About Node.js

mcollina theSnackOverflow pipobscure aduh95 panva Node.js GitHub Bot
6 people shipped this
mcollina @mcollina 6 cited theSnackOverflow @theSnackOverflow 1 cited pipobscure @pipobscure 1 cited aduh95 @aduh95 panva @panva Node.js GitHub Bot @nodejs-github-bot

Five undici security fixes address WebSocket, cache, and connection handling vulnerabilities, while Node.js core fixes permission audit mode and stream overhead.

The undici project shipped five security fixes addressing CVEs in WebSocket handling and cache behavior. One fix destroys the permessage-deflate inflater after decompression limit to prevent a late zlib error from becoming an uncaught exception (CVE-2026-85024) [1]. Another propagates connection-close failures through the retained writable stream controller, preventing an unobserved rejected promise from terminating the process (CVE-2026-85014) [2]. Cache fixes isolate interceptor state by dispatcher origin, deriving identities from the authoritative origin rather than caller-controlled metadata (CVE-2026-85152) [3], and reject caching of responses to unsafe methods like POST or DELETE, preventing replay (CVE-2026-85008) [4]. A fifth fix preserves BalancedPool connection options, which were dropped by a JSON-based deep clone, losing function-valued options like TLS certificate validation callbacks (CVE-2026-84961) [5].

Action items

References

  1. [1] fix(websocket): destroy inflater after decompression limit ↗ nodejs/undici
  2. [2] fix(websocket): error locked writable on unclean close ↗ nodejs/undici
  3. [3] fix(cache): isolate interceptor state by dispatcher origin ↗ nodejs/undici
  4. [4] fix(cache): reject unsafe method response caching ↗ nodejs/undici
  5. [5] fix: preserve BalancedPool connection options ↗ nodejs/undici
  6. [6] permission: do not enforce fs and addons in audit mode ↗ nodejs/node
  7. [7] stream: skip unobserved 'readable' emission at EOF ↗ nodejs/node
  8. [8] vfs: load native addons from a mounted file system ↗ nodejs/node

$ ls nodejs/reviews/ # the step-back reads

the week in review Domain runtime-deprecation lands; security patches ship the month in review Node 26 line lands crypto, stream, and FFI hardening as deprecations tighten the core
Topics: JavaScript Full archive →

Quick answers

What shipped in Node.js on September 5, 2026?
Five undici security fixes address WebSocket, cache, and connection handling vulnerabilities, while Node.js core fixes permission audit mode and stream overhead. In total, 50 commits, 20 pull requests, and 3 releases landed.
Who contributed to Node.js on September 5, 2026?
6 developers shipped this update, including theSnackOverflow, mcollina, pipobscure, aduh95, panva, and Node.js GitHub Bot.
What were the notable Node.js updates?
fix(websocket): destroy inflater after decompression limit, fix(websocket): error locked writable on unclean close, and fix(cache): isolate interceptor state by dispatcher origin.
♥

$ log @nodejs --recent

cjs-module-lexer scans faster, ffi throws on missing args 41 shipped Crypto fixes multi-prime RSA JWK handling, adds Hybrid KEMs 29 shipped domain runtime-deprecation lands; BlockList round-trip fixed 65 shipped Undici fixes cookie parser stack overflow, EventSource header injection risk 62 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.