$ ls nodejs/reviews/ # the step-back reads
Node.js in review
One review per week (and month): what shipped, what broke, what to act on.
Nov 2–8, 2026 weekly [act] 8 stories
commit-stream 3.0.0 restricts imports to package root
Undici closed two redirect credential leaks the same week node fixed QUIC streams losing data sent before a reader attached.
Oct 26–Nov 1, 2026 weekly [act] 8 stories
Node 26 enters LTS as Lithium; Node 27 alpha ships V8 15.6
Amaro 1.3.0 moves off async loaders to module.registerHooks, and core drops its OpenSSL 1.x code paths.
Oct 19–25, 2026 weekly [act] 8 stories
TLS rejects chains with blocked public keys
The same period shipped three breaking changes to crypto and permissions, plus faster AbortSignal and an HTTP/2 GOAWAY fix.
Oct 12–18, 2026 weekly [act] 8 stories
Five undici advisories hit, including a TLS validation bypass
Node 26.12.0 and 24.22.0 ship a WebSocket DoS patch; the four remaining undici fixes need an undici upgrade directly.
Oct 5–11, 2026 weekly [act] 8 stories
Node 26.11.0 lands buffer.isLatin1 and stringLength
The same release removes RSA-OAEP, KEM, and verify-setup key locking, and Node now loads most ES modules synchronously.
Oct 1–31, 2026 monthly [act] 8 stories
Node 26 enters LTS as five undici advisories land
Node 26.13.0 ships under the Lithium codename through April 2029, while undici patches a DoS, a TLS validation bypass and a cache poisoni...
Sep 28–Oct 4, 2026 weekly [act] 8 stories
node-gyp 13.1.0 patches tar CVE, raises CMake floor
Tar below 7.5.7 carries a hardlink path traversal, and gyp-next now demands CMake 3.10 for native builds.
Sep 21–27, 2026 weekly [plan] 8 stories
Node 26.10.0 ships crypto.parsePKCS12()
Undici 8.11.0 pushed HTTP/2 body-length validation, then reverted the fetch change that broke global fetch headers, while Node added --al...
Sep 14–20, 2026 weekly [act] 8 stories
Node 26.9.0 ships generic crypto MAC API
The Current release lands alongside an undici backpressure reversal, QUIC truncation fixes, and four embedder and TLS crash repairs.
Sep 7–13, 2026 weekly 8 stories
Undici 8.10.2 lands in Node
The runtime dependency bump headlines a week that also tightened FFI argument checks and sped up cjs-module-lexer's UTF-16 scans.
Sep 1–30, 2026 monthly [act] 8 stories
Node 26.10.0 lands crypto.parsePKCS12 as npm 12 ships
Two Current releases in September brought a generic MAC API and PKCS#12 parsing, while the permission model gained an environment gate.
Aug 31–Sep 6, 2026 weekly [act]
Domain runtime-deprecation lands; security patches ship
Node.js weekly: domain deprecated at runtime plus Undici fixes and crypto JWK corrections affect maintainers.
Aug 24–30, 2026 weekly
Compile cache goes read-only, TLS aborts become throws
This week Node.js hardened its compile cache into a read-only mode, turned TLS configuration aborts into proper throws, and landed a 10-2...
Aug 1–31, 2026 monthly
Node 26 line lands crypto, stream, and FFI hardening as deprecations tighten the core
August shipped two minor releases of Node 26 that carry performance, crypto, and stream changes while several runtime deprecations signal...
Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.