$ the-wire · showcase
net.BlockList fails closed, QUIC validates error codes
By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology
Node's core landed a security-relevant fix in net.Server access control and two API changes in process.finalization, while the rest of the tree stayed on dependency and CI maintenance.
net: fail closed when BlockList peer address is unavailable nodejs/node
When getpeername() could not return a peer address (a reset connection yields ENOTCONN from uv_tcp_getpeername()), the blockList check was skipped entirely and the connection advanced to the 'connection' handler, so a blocked peer got through. The check now fails closed: no peer address means no accept.
quic: validate stream error codes nodejs/node
RESET_STREAM, STOP_SENDING, and CONNECTION_CLOSE carry QUIC error codes as RFC 9000 variable length integers (0 through 2^62 - 1), and the code now validates them against those limits via a shared error type.
process: return unregister fn from finalization nodejs/node
register() and registerBeforeExit() return an unregister function that removes only that registration, leaving other handlers for the same object intact and holding no strong reference to it. unregister() also changes behavior: entries now actually leave the FinalizationRegistry, since each registration uses its WeakRef as the token rather than the object.
module: fix require(esm) on the module.register() hooks thread nodejs/node
require() of an ES module with imports, called while a module.register() hooks module loads on the hooks thread, has been throwing ERR_INTERNAL_ASSERTION in ModuleJobSync.syncLink() since the getOrCreateModuleJob() change made every request on that thread resolve asynchronously. This restores synchronous resolution for kImportInRequiredESM and kRequireInImportedCJS.
build(deps-dev): bump neostandard from 0.13.0 to 0.14.0 nodejs/undici
The long tail is routine: undici moves neostandard 0.13.0 to 0.14.0 and runs Python 3.14 for the WPT server on macOS, while userland-migrations bumps @ast-grep/napi to 0.50.0 and @types/node to 26.6.5.
