$ the-wire · showcase
Node fixes TSFN shutdown crash, http2 memory leak
By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology
Node landed a native-addon crash fix in node-api and released queued http2 memory on stream cancellation, while the v24 changelog gained a second CVE id for the non-canonical IP address fix.
node-api: fix crash on re-entering TSFN finalization during env shutdown nodejs/node
ThreadSafeFunction finalization no longer sets state = kClosed before calling into user code, which could re-enter napi_release_threadsafe_function and delete the TSFN synchronously in the middle of ThreadSafeFunction::MaybeDelete. Addons that release a TSFN from its own finalizer callback were hitting that shutdown crash; the fix removes the re-entrance window.
http2: release queued data memory on stream cancellation nodejs/node
Canceling a stream with queued outbound data used to leave that memory charged to maxSessionMemory, so later requests on the same session could be rejected even though the data was gone. Cleanup now releases the accounting when the write queue is torn down. The author notes it does not change response-header admission or the early-response issue.
doc: list CVE-2026-106072 in v24 changelog nodejs/node
The non-canonical IP address fix in v24.22.1 also covers CVE-2026-106072, and both CVE ids are now recorded in the release's notable changes. If you track Node advisories by id, the fix carries two.
doc: remove CI lockdown steps from security releases nodejs/node
security-release-process.md no longer tells releasers to lock down and unlock the CI on release day; the steps are removed and the checklist renumbered, matching releases.md, where the lockdown paragraph was already dropped.
feat: restore previous and next article navigation nodejs/learn
Learn articles get previous and next links at the end of the page again, reusing BaseCrossLink and the sidebar's article order, so readers on small screens no longer scroll back to the top dropdown. Elsewhere in the repo, Dependabot moved fast-uri from 3.1.8 to 3.1.9, a security release the notes describe as fixing four URI parsing and normalization vulnerabilities in 3.x, alongside an undici b...
