Node.js — full archive
179 daily briefings · 14 reviews.
$ ls nodejs/reviews/ # the step-back reads
- week commit-stream 3.0.0 restricts imports to package root
- week Node 26 enters LTS as Lithium; Node 27 alpha ships V8 15.6
- week TLS rejects chains with blocked public keys
- week Five undici advisories hit, including a TLS validation bypass
- week Node 26.11.0 lands buffer.isLatin1 and stringLength
- month Node 26 enters LTS as five undici advisories land
- week node-gyp 13.1.0 patches tar CVE, raises CMake floor
- week Node 26.10.0 ships crypto.parsePKCS12()
- week Node 26.9.0 ships generic crypto MAC API
- week Undici 8.10.2 lands in Node
- month Node 26.10.0 lands crypto.parsePKCS12 as npm 12 ships
- week Domain runtime-deprecation lands; security patches ship
- week Compile cache goes read-only, TLS aborts become throws
- month Node 26 line lands crypto, stream, and FFI hardening as deprecations tighten the core
- Workers preload streams into the startup snapshot; http2 accepts repeated content-encoding
- HTTP drain stalls after coalesced chunks, undici restores h2 error codes
- Stale OpenSSL errors cleared, npm 12.2.2 lands in node
- Node coalesces duplicate DNS lookups, batches HTTP body spans
- undici closes two redirect credential leaks
- v8 learns to serialize X509Certificate, http2 frees canceled-write memory
- QUIC stream data survives late readers, fromWeb writes keep async context
- commit-stream 3.0.0 locks imports to the package root
- Node fixes TSFN shutdown crash, http2 memory leak
- FFI callbacks no longer dangle after GC
- Node 27.0.0-alpha.0.0.0 lands with V8 15.6, and pipeTo keeps its async context
- Node 26 becomes LTS Lithium, alongside TLS session-reuse and http2 timeout fixes
- WebAssembly joins the compile cache, ZipEntry gets raw read methods
- Amaro 1.3.0 moves to registerHooks, snap stops nightly rollbacks
- OpenSSL 1.x support exits core, diagnostics_channel gets a use-after-free fix
- AbortSignal gets up to 11x faster; http2 stops hanging on GOAWAY
- HTTP/2 GOAWAY replay fix, test_runner gains --test-forbid-only
- Alpha release phase lands on nodejs.org download pages
- Node crypto reset across snapshots, Brotli and permission-model CVEs land in the security queue
- TLS gets a SPKI blocklist, NSS 3.131.1 roots land
- A "worker" condition for Web Workers, and a lint rule that catches dead benchmarks
- Dev dependency maintenance across nodejs tooling
- net.BlockList fails closed, QUIC validates error codes
- TransformStream construction trimmed, SEA archive mount re-landed
- Five undici DoS and TLS bypass advisories land at once
- Node 26.12.0 and 24.22.0 ship as undici patches a WebSocket DoS
- AsyncLocalStorage store restored in AsyncResource callbacks
- Node absorbs acorn 8.19.0, sqlite 3.54.0, and a V8 patch
- AbortSignal.any() leak fixed, diagnostics_channel context unblocked
- Faster http2 getHeaders, WASM errors on jitless builds
- cjs-module-lexer drops Node.js 18, doc-kit opens its Markdown pipeline
- Undici caps cached and error-body retention, drops Milo from the Node core bundle
- Node 26.11.0 lands Latin1 checks and stringLength as crypto locks come out
- Node loads most ES modules synchronously
- V8 drops the flag override, so jitless and lite modes come back
- Node.js migrates off deprecated V8 APIs and fixes a long-silent Windows ICU path
- Undici caps EventSource buffering, node:ffi takes plain integers
- Legacy AsyncLocalStorage removed, FFI permission checks dropped
- node-gyp 13.1.0 fixes --msvs_version, and citgm's red builds traced to loglevel precedence
- child_process spawn gets 20% faster, QUIC macro cleaned up
- WebCrypto raw key export throws InvalidAccessError, node-gyp pins patched tar
- gyp-next raises CMake floor to 3.10, node trims flaky test list
- Retired undici pool clients, a faster Buffer.isLatin1, and reports that finish on timeout
- Node adds --allow-env permission, brotli reset fix
- localStorage hardens on bad files, sqlite classes get new names
- npm 12 lands in node, histogram.diff() for perf_hooks
- Undici reverts HTTP/2 fetch change, websocket fixes land
- Node 26.10.0 lands with crypto.parsePKCS12()
- undici 8.11.0 lands HTTP/2 length checks and WebSocket fixes
- Cheaper short-lived web streams, shared cleanup hooks per isolate
- SEA gets ZIP asset archives, HTTP server sheds per-request allocations
- Buffer.stringLength(), and a trace_events abort for embedders
- cpSync dereference regression fixed, trace union punning removed
- Node 26.9.0 adds a generic MAC API, undici walks back its decompression size cap
- QUIC no longer reports truncated streams as complete
- HTTP/2 restored for built-in fetch, http2 onread assert fixed
- Embedder abort fix, safer snapshot blobs
- dgram skips custom lookup for literal IPs, node:bench gated behind a flag
- Undici stops HTTP/2 pool fan-out, Node's TLS state machine gets re-entrancy guards
- Undici unrefs keep h2 WebSockets alive, adds private-field brand checks
Never miss a Node.js briefing.
Get Node.js's week in review every Monday - and security advisories the day they land. Free, unsubscribe in one click.
One click. Every Monday: what mattered across the projects you've been reading (or our AI picks) — security news same-day. You refine anytime. Choose specific journals · Read a sample issue →