Node 26.10.0 lands crypto.parsePKCS12 as npm 12 ships

By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology

♥

Two Current releases in September brought a generic MAC API and PKCS#12 parsing, while the permission model gained an environment gate.

725 commits 489 PRs merged 16 releases 30 briefings covered

all nodejs reviews →

← previous month nodejs wire →

2026-09-22, Version 26.10.0 (Current), @aduh95 nodejs/node

by aduh95

The month's second Current release adds crypto.parsePKCS12(), giving you PKCS#12 parsing through node:crypto instead of an external library. It follows 26.9.0, which shipped a generic MAC API.

fix: avoid unbounded recursion in Set-Cookie attribute parser nodejs/undici

by mcollina

The Set-Cookie attribute parser recursed once per attribute with no depth bound, so a single header of the form a=b;;;;... overflowed the stack and threw an uncaught RangeError out of getSetCookies. The algorithm is now iterative; a response header is attacker-controlled input in most proxies and gateways.

fix(eventsource): validate Last-Event-ID on reconnect nodejs/undici

by mcollina

EventSource reconnects now UTF-8 encode the last event ID before adding it to the request header list and omit IDs that cannot be transported as header values, which stops repeated local reconnect failures while keeping valid Unicode IDs. Tracked as GHSA-q9qx-47rg-rhc7, it is a header-injection fix.

fs: watch directories, not files, in recursive fs.watch fallback nodejs/node

by codebytere

On Linux, where fs.watch() has no native recursive mode, the JavaScript fallback armed one watcher and one stat() per file and re-read the whole parent directory on every event. It now arms one watcher per directory and answers each event with a single stat(); the notes cite this repository's test/ tree at 13,500 entries and 896 directories.

v8: add setHeapProfileNearHeapLimit nodejs/node

by IlyasShabi

v8.setHeapProfileNearHeapLimit(limit) writes a sampling heap profile to disk as V8 approaches the heap limit, for the cases where a full heap snapshot is too heavy. Pair it with the existing snapshot API when you need allocation attribution from a production OOM.

diagnostics_channel: lazily create tracing context nodejs/node

by RomainLanz

The tracing channel context is now created lazily, so code that only checks whether a channel is subscribed no longer pays for building one. If your HTTP router calls hasSubscribers before publishing, this is the path that got cheaper.

permission: support URL and Uint8Array as has()/drop() reference nodejs/node

by nhjbest22

process.permission.has() and drop() accept a WHATWG URL (resolved through fileURLToPath() for fs.* scopes) and a plain Uint8Array alongside strings and Buffers. Permission checks written against URL objects no longer need manual conversion first.

v8.11.0 nodejs/undici

by github-actions[bot]

Alongside: undici 8.11.0 with HTTP/2 length checks and WebSocket fixes, vfs rename over a non-empty directory, WPT streams tests updated to 4832db4761, SOCKS5 connectTimeout honored through ProxyAgent, and resource timing attributes like finalResponseHeadersStart added.

$ ls nodejs/month/ # the briefings behind this review

Tue Sep 1 Recursive fs.watch fallback now watches directories, not files Wed Sep 2 Node.js adds v8.setHeapProfileNearHeapLimit, fixes environment live lock Thu Sep 3 Undici fixes cookie parser stack overflow, EventSource header injection risk Fri Sep 4 domain runtime-deprecation lands; BlockList round-trip fixed Sat Sep 5 Node.js security patches land, permission audit mode fixes, and stream EOF optimization Sun Sep 6 Crypto fixes multi-prime RSA JWK handling, adds Hybrid KEMs Mon Sep 7 cjs-module-lexer scans faster, ffi throws on missing args Tue Sep 8 Node fixes rmSync on Windows, V8 debugger plugin support Wed Sep 9 Node's SQLite binds undefined to NULL, node-gyp reads the documented flag Thu Sep 10 Node 26.8.2 ships OpenSSL 3.5.8 and an HTTP/2 window override Fri Sep 11 Undici unrefs keep h2 WebSockets alive, adds private-field brand checks Sat Sep 12 Undici stops HTTP/2 pool fan-out, Node's TLS state machine gets re-entrancy guards Sun Sep 13 dgram skips custom lookup for literal IPs, node:bench gated behind a flag Mon Sep 14 Embedder abort fix, safer snapshot blobs Tue Sep 15 HTTP/2 restored for built-in fetch, http2 onread assert fixed Wed Sep 16 QUIC no longer reports truncated streams as complete Thu Sep 17 Node 26.9.0 adds a generic MAC API, undici walks back its decompression size cap Fri Sep 18 cpSync dereference regression fixed, trace union punning removed Sat Sep 19 Buffer.stringLength(), and a trace_events abort for embedders Sun Sep 20 SEA gets ZIP asset archives, HTTP server sheds per-request allocations Mon Sep 21 Cheaper short-lived web streams, shared cleanup hooks per isolate Tue Sep 22 undici 8.11.0 lands HTTP/2 length checks and WebSocket fixes Wed Sep 23 Node 26.10.0 lands with crypto.parsePKCS12() Thu Sep 24 Undici reverts HTTP/2 fetch change, websocket fixes land Fri Sep 25 npm 12 lands in node, histogram.diff() for perf_hooks Sat Sep 26 localStorage hardens on bad files, sqlite classes get new names Sun Sep 27 Node adds --allow-env permission, brotli reset fix Mon Sep 28 Retired undici pool clients, a faster Buffer.isLatin1, and reports that finish on timeout Tue Sep 29 gyp-next raises CMake floor to 3.10, node trims flaky test list Wed Sep 30 WebCrypto raw key export throws InvalidAccessError, node-gyp pins patched tar

all nodejs reviews →

← previous month nodejs wire →