129 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-20
stories 28

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

SEA gets ZIP asset archives, HTTP server sheds per-request allocations

By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology

Node.js landed two runtime-facing changes: a "vfsArchive" option that serves SEA assets straight from a prebuilt ZIP, and an HTTP server pass that removes the closures and header lookups paid on every request.

sea: add vfsArchive to serve the assets from a ZIP archive nodejs/node

by mcollina

Matteo Collina added a "vfsArchive" option to the SEA configuration, letting --build-sea embed a prebuilt ZIP verbatim as a single reserved asset instead of listing individual "assets" entries; the same work fixed a performance bug in the SEA asset lookup found while benchmarking it.

http: reduce per-request allocations in the server nodejs/node

by mcollina

updateOutgoingData.bind() is now one closure per connection reused by every response, resOnFinish.bind() became a shared 'finish' listener that reaches state through the connection stored on the response, and the Host, Expect, Content-Length and Transfer-Encoding header checks can skip materializing req.headers. Every Node HTTP server pays these costs once per request today, so the win scales w...

tls: preserve CN name constraints with OpenSSL 4.1 nodejs/node

by panva

OpenSSL 4.1 stopped applying DNS name constraints to the subject CN by default, while tls.checkServerIdentity() still consults it when no DNS SAN is present, so the patch enables subject name constraints to preserve the existing behavior. Relevant if you build against or test against OpenSSL 4.1.

doc: document the node:ffi call paths nodejs/node

by soulee-dev

doc/api/ffi.md now documents all three node:ffi call paths, the V8 Fast API with a generated trampoline, the per-function shared buffer path that was previously undocumented, and the generic libffi invoker, plus the order in which one is selected and which signatures qualify.

adds beta docs to learn nodejs/learn

by bmuenzenmeyer

Beta docs now appear in learn, reordered after the current docs, with a ui-components bump to fix the nav accent and lint left off for the moment. The doc-kit packages moved from 1.4.3 to 2.0.2 in the same stretch of dependabot work.

Quick answers

What shipped in Node.js on September 20, 2026?
Node.js landed two runtime-facing changes: a "vfsArchive" option that serves SEA assets straight from a prebuilt ZIP, and an HTTP server pass that removes the closures and header lookups paid on every request. In total, 13 commits and 15 pull requests landed.
Who contributed to Node.js on September 20, 2026?
6 developers shipped this update, including dependabot, bmuenzenmeyer, mcollina, soulee-dev, panva, and Node.js GitHub Bot.
What were the notable Node.js updates?
sea: add vfsArchive to serve the assets from a ZIP archive, http: reduce per-request allocations in the server, and tls: preserve CN name constraints with OpenSSL 4.1.