129 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-15
stories 32

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

HTTP/2 restored for built-in fetch, http2 onread assert fixed

By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology

Node's own runtime bit twice today: a one-line dispatcher override that silently downgraded built-in fetch() to HTTP/1.1 is now scoped to upgrades only, and a deferred-close race that aborted sessions with an onread assert is closed at the source.

fix: preserve HTTP/2 for non-upgrade legacy requests nodejs/undici

by mcollina

Dispatcher1Wrapper forced allowH2: false on every request, so any Node.js version whose built-in fetch() consumes undici.globalDispatcher could not negotiate HTTP/2. mcollina restricts that HTTP/1.1 compatibility override to upgrade requests, keeps the native WebSocket fallback on HTTP/1.1 with an asserted protocol, and adds an HTTP/2-only server fixture so the regression cannot return silently.

http2: fix onread assert when destroying session from stream handler nodejs/node

by Sankalp Thakur

When session.destroy() runs from a 'stream' handler, MakeCallback drains nextTick while nghttp2 is still inside mem_recv, and HEADERS arriving in that window created C++ streams with no JS wrapper or onread, ending in Assertion failed: onread->IsFunction(). The fix rejects new streams while the session is closing and destroys the C++ handle when on_headers runs after close, removing a hard cras...

fix: skip drain dispatch for clientTtl-evicted clients in PoolBase nodejs/undici

by vwong

Evicted clients in a Pool configured with clientTtl could still emit drain events after close, and kOnDrain would dispatch queued items to them, throwing ClientClosedError. The race is narrow same-region but widens to hundreds of milliseconds with cross-region TLS connection times, which is exactly the deployment shape that will hit it.

perf_hooks: implement SlidingWindowHistogram nodejs/node

by James M Snell

The recordable Histogram accumulates samples indefinitely with no notion of time; jasnell's SlidingWindowHistogram keeps the window fixed and bounded, count or time based, over an internal ring buffer of histograms. Snapshotting a bounded window is what makes peak-latency numbers from perf_hooks usable in long-running processes.

test(h2): stabilize http2-connection (#5801) nodejs/undici

by Carlos Vinicius

The last of the [flaky] http2 test files gets the hardening its siblings already received: the unexpected-disconnect guard ignores the client's own idle-socket teardown after keepAliveTimeout, since the client reconnects transparently, and now lives in test/utils/h2-disconnect-guard.js with coverage. It also swaps per-test RSA-2048 keygen for a static pem. The crowded but routine tail: a v8 ser...

Quick answers

What shipped in Node.js on September 15, 2026?
Node's own runtime bit twice today: a one-line dispatcher override that silently downgraded built-in fetch() to HTTP/1.1 is now scoped to upgrades only, and a deferred-close race that aborted sessions with an onread assert is closed at the source. In total, 19 commits and 13 pull requests landed.
Who contributed to Node.js on September 15, 2026?
11 developers shipped this update, including mcollina, ViniciusDev26, vwong, NgoQuocViet2001, Rafael Gonzaga, Sankalp Thakur, panva, and James M Snell, and 3 more.
What were the notable Node.js updates?
fix: preserve HTTP/2 for non-upgrade legacy requests, http2: fix onread assert when destroying session from stream handler, and fix: skip drain dispatch for clientTtl-evicted clients in PoolBase.