$ the-wire · showcase
Node 26.12.0 and 24.22.0 ship as undici patches a WebSocket DoS
By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology
A pair of releases landed on the current and LTS lines while undici's WebSocket client picked up a denial-of-service fix and an October security release was announced for Node.js itself.
undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake nodejs/undici
A failed HTTP/2 handshake can be used to drive a denial of service against the undici WebSocket client, which sits under any code that reaches for a WebSocket through Node's built-in fetch stack. Treat this as the reason to take the next undici release, not the version bump below.
2026-10-14, Version 26.12.0 (Current), @richardlau nodejs/node
The Current line moves to 26.12.0, adding websocketMask() and websocketUnmask() in the http module and making Node throw on missing WebAssembly or RX support rather than degrade quietly. Both are SEMVER-MINOR, so code relying on the previous silent behavior under absent WASM support needs a look.
2026-10-14, Version 24.22.0 'Krypton' (LTS), @richardlau prepared by @aduh95 nodejs/node
LTS Krypton gets crypto.parsePKCS12() and a generic MAC API, both SEMVER-MINOR additions to the stable surface for anyone parsing PKCS#12 bundles or reaching for HMAC-adjacent primitives.
sqlite: use shared-shape objects for result rows nodejs/node
SQLite result rows from all(), get(), and iterate() were built through an Object::New() overload that always produced dictionary-mode objects, meaning no two rows shared a map and every property read was a hash lookup, as the author put it; rows now come from a DictionaryTemplate cached on the statement, while keeping their null prototype and falling back for column names a template can't express.
v8.12.0 nodejs/undici
undici 8.12.0 collects the smaller fixes: numeric cookie expires values outside the Date range are ignored, http2 pauses bodyTimeout while applying backpressure, and the cache, deduplicate, and decompress paths get corrections.
split wpt out of npm test (#5588) nodejs/undici
npm test no longer runs the slow WPT suite locally; the test:wpt script stays available for explicit invocation and CI runs WPT as its own step.
fix: reject unsupported FormData request bodies (#5913) nodejs/undici
In the long tail: unsupported FormData request bodies are now rejected outright, missing release refs no longer break cleanup, the WebCryptoAPI WPT snapshot was bumped, the _http_* internals are deprecated, and the 2026-10-15 reliability report is filed.
Action items
- → Upgrade undici past 8.12.0 once the WebSocket HTTP/2 handshake DoS fix lands nodejs/undici [plan]
