$ the-wire · showcase
TLS gets a SPKI blocklist, NSS 3.131.1 roots land
By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology
Node.js added a compiled-in blocklist of SubjectPublicKeyInfo SHA-256 hashes so chains through a compromised intermediate CA stop verifying, and refreshed the embedded Mozilla root store to NSS 3.131.1.
tls: reject chains containing blocked public keys nodejs/node
Node.js embedded the Mozilla root store but had no CRLSet/OneCRL equivalent and no default online revocation checking, so a chain through a compromised intermediate still verified as long as it reached a trusted root; removing the affected roots would over-block, since other legitimate intermediates chain to them. The new blocklist is checked from a single SSL_CTX_set_cert_verify_callback hook ...
crypto: update root certificates to NSS 3.131.1 nodejs/node
certdata.txt now comes from NSS 3.131.1, and three emSign roots are gone: emSign ECC Root CA - G3, emSign Root CA - C1, and emSign ECC Root CA - C3. Any connection relying on those chains will fail verification after this lands, so check pinned or private-PKI setups that terminate through them.
deps: update c-ares to 1.34.9 nodejs/node
c-ares moved to 1.34.9, the resolver library behind name lookups in Node.js, in an automated dependency update.
perf(legacy-html): stop re-parsing shiki themes per code block nodejs/doc-kit
legacy-html passed theme objects to codeToHast, and Shiki normalized them into new objects on each call, so its theme cache never hit and both themes were re-parsed for every code block, roughly 3.8s of CPU per build. The highlighter now loads the catppuccin themes and highlights by name, the way highlighter.mjs already did.
Add report for 2026-10-21 nodejs/reliability
The reliability working group published its report for 2026-10-21; nothing in it requires action from consumers.
Action items
