179 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-10-25
stories 17

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

AbortSignal gets up to 11x faster; http2 stops hanging on GOAWAY

By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology

Node's hot cancellation paths got a substantial speedup and an http2 fix closes a case where a peer's graceful GOAWAY could leave streams open indefinitely.

lib: speed up AbortSignal nodejs/node

by ronag

ronag reworked the hot AbortController and AbortSignal paths: aborting a controller is 3.5-11x faster (2.7x with the default reason), signal creation 1.8x, listener add/remove 1.5-1.6x, with AbortSignal.any() ~2x and AbortSignal.timeout() ~1.75x. Plain EventTarget listener add/remove and dispatch are unchanged within noise, so the win is scoped to abort semantics rather than the whole event layer.

http2: don't suppress internal termination detection on a peer GOAWAY nodejs/node

by mcollina

When a peer sends GOAWAY(NO_ERROR), core.js calls session.close(), which sets graceful_close_initiated_ and goaway_initiated_ without any application code involved. That disarmed detection of nghttp2 terminating the session internally after a protocol error, leaving open streams and the connection hanging. The fix also treats a session as internally terminated when nghttp2 wants neither read no...

sqlite: skip return() on exhausted virtual table iterators nodejs/node

by trivikr

CloseIterator() now skips cursors whose iteration has already reported done: true, matching for...of, which calls return() only on abrupt termination. Before this, an empty custom iterable with a throwing return() made an otherwise successful SQLite query fail.

tls,tools: update BoringSSL pin and TLS errors nodejs/node

by Filip Skokan

Shared-library builds move to BoringSSL 0.20261020.0. The new verifier no longer emits UNABLE_TO_VERIFY_LEAF_SIGNATURE after Node's verification callback accepts a missing-issuer error; affected leaf certificates now produce UNABLE_TO_GET_ISSUER_CERT_LOCALLY, and that error suggests --use-system-ca. The SSL_get_server_tmp_key() fallback is dropped now that BoringSSL supplies SSL_get_peer_tmp_key.

test: remove obsolete BoringSSL skips nodejs/node

by Filip Skokan

panva removed the BoringSSL test skips for supported DH, ECDH, legacy TLS, TLS 1.2 PSK, cipher metadata, raw key, and X.509 date cases, narrowing key/cert array exclusions to the multi-identity cases that still fail. Separately, release-cloudflare-worker dropped its www server fallback logic.

Quick answers

What shipped in Node.js on October 25, 2026?
Node's hot cancellation paths got a substantial speedup and an http2 fix closes a case where a peer's graceful GOAWAY could leave streams open indefinitely. In total, 11 commits and 6 pull requests landed.
Who contributed to Node.js on October 25, 2026?
6 developers shipped this update, including trivikr, mcollina, ronag, Filip Skokan, flakey5, and Node.js GitHub Bot.
What were the notable Node.js updates?
lib: speed up AbortSignal, http2: don't suppress internal termination detection on a peer GOAWAY, and sqlite: skip return() on exhausted virtual table iterators.