$ cat nodejs/week/2026-09-21.log
the week in review · Sep 21 – Sep 27, 2026
Node 26.10.0 ships crypto.parsePKCS12()
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Undici 8.11.0 pushed HTTP/2 body-length validation, then reverted the fetch change that broke global fetch headers, while Node added --allow-env.
2026-09-22, Version 26.10.0 (Current), @aduh95 nodejs/node
The semver-minor release adds crypto.parsePKCS12(), giving scripts a built-in way to read .p12 key material instead of reaching for an external library. It also carries the portable-SQLite and permission changes that landed across the week.
fix(h2): validate response content-length nodejs/undici
The HTTP/2 client now compares response Content-Length against the DATA bytes actually received, so truncated and oversized bodies fail with the existing length-mismatch error rather than passing through. HEAD and 304 semantics are preserved and there is fetch regression coverage for mismatches and session reuse.
Revert "fix: preserve HTTP/2 for legacy fetch consumers" nodejs/undici
Allowing HTTP/2 through Dispatcher1Wrapper passed object-form headers to legacy callbacks, which cost Node's global fetch its response headers and redirect following, so the change is out. Regression coverage uses an HTTP/2-capable server, which means anyone who adopted 8.11.0's H2 fetch path should move to the revert.
src: let Environments on one isolate share a cleanup hook nodejs/node
Two Environments sharing an isolate that register the same cleanup hook aborted the process on the second napi_add_env_cleanup_hook() call, a normal pattern for an addon loaded into several Environments (Electron subframes and same-process child windows share Blink's isolate). Hooks are now shared per isolate, so native addons in those hosts stop taking the process down.
fix(websocket): reset the compressed flag when a message completes nodejs/undici
ByteParser never cleared its compressed flag after delivering a permessage-deflate message, leaving the flag describing the previous message while the next frame header was parsed, which tripped the continuation-frame guard. Clients decoding deflate-compressed frames now get correct message boundaries.
stream: trim per-stream costs in webstreams nodejs/node
Short-lived streams (create, a few chunks, close) pay a fixed per-stream cost that dominates once the per-chunk path is lean, and streams Node builds internally (transform sides, tee branches, ReadableStream.from, transferred streams) were adding to it. If your hot path opens many small web streams, that overhead is what this round targets.
vfs: support recursive readdir in ZipProvider nodejs/node
ZipProvider threw ERR_METHOD_NOT_IMPLEMENTED for readdir() with { recursive: true } even though an archive already stores every member under its full path, so a recursive listing is the same scan of entry names as a flat one. Recursive listings now stay inside the directory instead of returning only the first path segment.
watch: strip watch flags from NODE_OPTIONS in child process nodejs/node
When NODE_OPTIONS contains --watch, the parent spawns a child that inherits the same options and enters watch mode too, which spawns another child, indefinitely. Watch-related flags are now stripped from NODE_OPTIONS in the child, so setting --watch globally no longer forks forever.
$ ls nodejs/week/ # the briefings behind this review
Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.