$ cat nodejs/week/2026-09-14.log
the week in review · Sep 14 – Sep 20, 2026
Node 26.9.0 ships generic crypto MAC API
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
The Current release lands alongside an undici backpressure reversal, QUIC truncation fixes, and four embedder and TLS crash repairs.
2026-09-16, Version 26.9.0 (Current), @aduh95 nodejs/node
The headline change is a generic MAC API in node:crypto, a semver-minor addition marked in the release notes. If you have ever hand-rolled HMAC or reached for an external module to get a second MAC construction, that gap is now closed in core. Everything else in the release is routine.
fix: honor backpressure in decompression interceptor nodejs/undici
Undici's author reversed course on the 64 MiB decoded-response cap introduced alongside the earlier GHSA fix, writing that "I made a mess of the original GHSA fix by treating a stream backpressure bug as a response-size policy decision." The decompression interceptor now honors stream backpressure instead of rejecting large responses outright, so streaming consumers stop losing legitimate paylo...
fix: preserve HTTP/2 for non-upgrade legacy requests nodejs/undici
The HTTP/1.1 compatibility override that applied to all legacy requests now applies only to upgrade requests, letting built-in fetch() negotiate HTTP/2 again through the undici v8 global dispatcher. An HTTP/2-only server test covers the path. If your code served h2 through Node's fetch and quietly fell back to 1.1, this restores it.
quic: fix readable stream truncation on stop-sending, abort & timeout nodejs/node
Streams closed by idle timeout, local destroy, or remote abort were surfaced as successfully completed on the iterable, silently truncating data. Code that read QUIC stream contents until the iterator reported done was accepting partial payloads as whole ones; those paths now report the failure.
src: fix abort when two Environments share an IsolateData nodejs/node
Creating a second Environment from the same IsolateData aborted the moment it ran require('net'), because several wrap and crypto key classes build per-isolate templates from the per-Environment context. doc/api/embedding.md permits the pattern and the cctest fixture exercises it, so embedded runtimes with more than one Environment were exposed to a hard crash.
src: fix crash on empty, foreign or truncated --snapshot-blob files nodejs/node
Passing an empty file, a non-snapshot file, or a blob with a zero-length startup section to --snapshot-blob hit assertions in ReadFileSync and the magic-number check. These now fail with proper errors, which matters to anyone generating snapshot blobs in a build pipeline where an empty or foreign artifact previously took the process down instead of reporting bad input.
tls: propagate singleUse to the secure context nodejs/node
tls.connect() sets options.singleUse, and the TLS wrap and socket both check ssl._secureContext.singleUse before releasing the SSL_CTX, but nothing ever assigned the flag to the context. That release path was dead. Single-use secure contexts now actually get closed when the socket goes away.
http: don't destroy socket after request completes nodejs/node
Aborting a ClientRequest after the response had fully arrived still called socket.destroy(err), and the resulting 'error' landed a tick later, where it could hit a socket already assigned to the next response. Aborts in that post-completion window no longer tear down a socket the pool is about to reuse.
$ ls nodejs/week/ # the briefings behind this review
Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.