RepoJournal
Node.js @nodejs
116 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-06
stories 29
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Crypto fixes multi-prime RSA JWK handling, adds Hybrid KEMs

By RepoJournal · Filed · About Node.js

panva btea Node.js GitHub Bot
3 people shipped this
panva @panva 3 cited btea @btea 1 cited Node.js GitHub Bot @nodejs-github-bot 1 cited

Node.js crypto gets two significant updates: consistent multi-prime RSA key handling across formats and experimental Hybrid KEM support in Web Cryptography.

A fix for multi-prime RSA keys in nodejs/node closes an inconsistency between PKCS#8 and JWK formats [1]. Previously, converting a multi-prime PKCS#8 key to JWK omitted the `oth` member, importing a JWK discarded additional primes, and exporting a JWK to PKCS#8 could produce an invalid two-prime key (or was unreachable). After this change, all operations preserve all primes: PKCS#8 to JWK includes `oth`, JWK imports all primes, and JWK to PKCS#8 produces a valid key with all primes. This is a behavior change for anyone handling multi-prime RSA keys through JWK; keys that were previously rejected or silently truncated will now be handled fully.

Web Cryptography now includes Hybrid KEM algorithms, added experimentally and disabled under FIPS at startup [2]. The implementation is composed in JavaScript because the underlying primitives are not yet available; the PR notes "The hybrid JS side composition and secondary handle slots will all go away when OpenSSL lands support for these," which would also enable them in `node:crypto` encap/decap.

Test and benchmark infrastructure now uses a new `isBoringSSL` helper and has migrated `hasOpenSSL3` call sites to `hasOpenSSL(3)` [3]. The older helper remains in place for now to avoid conflicts with in-flight PRs, but the direction is set for its eventual removal.

Lower-priority updates: the doc-kit contributing guide was refreshed [4], and a reliability report for 2026-09-06 was added [5].

$ ls nodejs/reviews/ # the step-back reads

the week in review Domain runtime-deprecation lands; security patches ship the month in review Node 26 line lands crypto, stream, and FFI hardening as deprecations tighten the core
Topics: JavaScript Full archive →

Quick answers

What shipped in Node.js on September 6, 2026?
Node.js crypto gets two significant updates: consistent multi-prime RSA key handling across formats and experimental Hybrid KEM support in Web Cryptography. In total, 20 commits and 9 pull requests landed.
Who contributed to Node.js on September 6, 2026?
3 developers shipped this update, including panva, btea, and Node.js GitHub Bot.
What were the notable Node.js updates?
crypto: fix multi-prime RSA JWKs, crypto: add Hybrid KEMs to Web Cryptography, and test,benchmark: use OpenSSL feature helpers.
♥

$ log @nodejs --recent

cjs-module-lexer scans faster, ffi throws on missing args 41 shipped Node.js security patches land, permission audit mode fixes, and stream EOF optimization 73 shipped domain runtime-deprecation lands; BlockList round-trip fixed 65 shipped Undici fixes cookie parser stack overflow, EventSource header injection risk 62 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.