iiinova — where your digital self keeps evolving

Reposted by Node.js

OpenJS Foundation @openjsf.org · 25/09/2026

Finding vulnerabilities is only part of the work. Maintainers still need resources to triage, patch, and ship secure releases. The new OpenJS Security Stewardship Program will fund researchers and maintainers, starting with Node.js. openjsf.org/blog/openjs-...

081

Node.js @nodejs.org · 26/08/2026

Are you a Node.js user? We want your feedback. Tell us all about how you're using Node.js in our annual user survey. Your response helps shape our future priorities! linuxfoundation.surveymonkey.com/r/…

02711

Node.js @nodejs.org · 20/08/2026

Node.js Interactive 2026 brought together the developers and maintainers shaping the future of Node.js. Read the full Node.js Interactive 2026 recap 👇 bit.ly/4gix0zB Thanks @aviv.sh for the post!

bit.ly

Node.js — Node.js Interactive 2026: A Recap

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

1295

Node.js @nodejs.org · 07/08/2026

Registration is still open: www.renderatl.com/node

040

Node.js @nodejs.org · 07/08/2026

Join us in the nodejs-interactive-code-and-learn channel in Render's Discord: renderatl.com/discord

120

Node.js @nodejs.org · 07/08/2026

Want to contribute to Node.js but don't know where to start? The Node.js Interactive Code and Learn workshop at RenderATL is this Thursday, August 13 — a hands-on session to make your first real contribution to the project.

2261

Reposted by Node.js

Antoine du Hamel @aduh95.bsky.social · 05/08/2026

📣 New Node.js release 📣 Node.js 26.7.0 is out with Perfetto tracing support, STORE loaders for private keys, and `module.register()` hooks are now disposable, plus many patches. Full changelog and download links available at nodejs.org/en/blog/rele...

nodejs.org

Node.js — Node.js 26.7.0 (Current)

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

0265

Node.js @nodejs.org · 09/07/2026

Node.js Interactive @ RenderATL lineup announced. QUIC in core. Built-in TypeScript in Node 26. Event loop deep dives. npm supply chain security. MCP for backends. doc-kit. Integration testing. Platform thinking. Full speaker list: bit.ly/3R1zbz8 Join us in Atlanta: bit.ly/4f7HNvY

0203

Node.js @nodejs.org · 01/07/2026

New to open source, or wondering how to get your first Node.js contribution landed and released? Check out our new first-time contributors guide, with practical tips and answers to FAQs about working with our volunteer-driven model. bit.ly/4avNtP2

github.com

node/doc/contributing/first-contributions.md at main · nodejs/node

Node.js JavaScript runtime ✨🐢🚀✨. Contribute to nodejs/node development by creating an account on GitHub.

1377

Reposted by Node.js

Antoine du Hamel @aduh95.bsky.social · 25/06/2026

Node.js 26.4.0 is out with a new `node:vfs` built-in module (behind `--experimental-vfs` flag). It also adds support for package maps, and many bug fixes, including a fix for a regression shipped with last week security release. Full changelog and download links at nodejs.org/en/blog/rele...

nodejs.org

Node.js — Node.js 26.4.0 (Current)

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

03212

Reposted by Node.js

Richard Lau @rwklau.bsky.social · 24/06/2026

New @nodejs.org 24.18.0 release is now out. nodejs.org/en/blog/rele... This fixes a couple of regressions: - github.com/nodejs/node/... - github.com/nodejs/node/...

nodejs.org

Node.js — Node.js 24.18.0 (LTS)

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

0154

Node.js @nodejs.org · 11/06/2026

⚠️ Security release pre-alert: Node.js will release new versions of the 26.x, 24.x, 22.x releases lines on or shortly after June 17, 2026 in order to address one or more security issues, the highest severity is HIGH. Details: nodejs.org/en/blog/vulnerability/ju…

0323

Reposted by Node.js

NodeConf.eu @nodeconf.eu · 10/06/2026

#NodeConf EU is back! If you've been working on something worth sharing about #Node.js internals, performance, #developer experience, or anything in between, this is the stage for you! nodeconf.eu See you in Bologna! 🇮🇹

02210

Node.js @nodejs.org · 03/06/2026

Node.js Interactive returns at RenderATL 2026. Join maintainers, contributors, and developers for two days of talks on Node.js performance, security, AI tooling, infrastructure, and the real world challenges of running JavaScript at scale. bit.ly/43aFSBs

0195

Reposted by Node.js

Antoine du Hamel @aduh95.bsky.social · 01/06/2026

Node.js 26.3.0 is out with a bunch of various fixes, and a new `process.permission.drop()` API (shoutout to @rafaelgss.dev!). Full changelog and download links available at nodejs.org/en/blog/rele...

0244

Reposted by Node.js

Antoine du Hamel @aduh95.bsky.social · 21/05/2026

Another day, another Node.js release :) Node.js 24.16.0 is out! A few test runner features, `randomUUIDv7`, plus many more bug fixes and small improvements. Full changelog and download links at nodejs.org/en/blog/rele...

nodejs.org

1186

Reposted by Node.js

Antoine du Hamel @aduh95.bsky.social · 20/05/2026

Node.js 26.2.0 is out! `stream.compose` is now stable, `node:fs` integrates with the new `Temporal` API, and a fair load of bug fixes. Full changelog and download links at nodejs.org/en/blog/rele...

nodejs.org

Node.js — Node.js 26.2.0 (Current)

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

03910

Node.js @nodejs.org · 15/05/2026

⚠️ Node.js 20 is officially End-of-Life. Join members of the Node.js Technical Steering Committee Matteo Collina and Marco Ippolito as we discuss how to navigate this transition safely. 📅 May 27 | 11:00 AM EST 👉 Register for the live session: bit.ly/4tzcAqE

1190

Node.js @nodejs.org · 08/05/2026

ICYMI (and we hope you didn't): Node.js 20 went EOL last week. But you have options. Check out our EOL support: nodejs.org/en/about/eol

0213

Reposted by Node.js

Antoine du Hamel @aduh95.bsky.social · 07/05/2026

Node.js 26.1.0 is out, with a new `node:ffi` module, `crypto.randomUUIDv7()`, and many more features and bug fixes. Full changelog and download links at nodejs.org/en/blog/rele...

nodejs.org

Node.js — Node.js 26.1.0 (Current)

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

0379

Reposted by Node.js

Rafael Gonzaga | Node.js @rafaelgss.dev · 05/05/2026

Node.js v26.0.0 is out 💚 Temporal API enabled by default, V8 14.6, Undici 8, and key deprecations as we keep modernizing the platform. Check it out nodejs.org/en/blog/rele...

nodejs.org

Node.js — Node.js 26.0.0 (Current)

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

112735

Node.js @nodejs.org · 04/05/2026

The 2026 Node.js London Collaboration Summit trip report is officially live! 🚀 We gathered 50+ contributors to discuss the biggest technical shifts coming to the runtime. Big thanks to Bloomberg for hosting! 🇬🇧 Check out the full recap and recordings here: bit.ly/3OHPLmz

bit.ly

Node.js — Trip report: Node.js collaboration summit (2026 London)

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

02110

Node.js @nodejs.org · 25/03/2026

The fix has been merged into V8 and can be enabled via `v8_enable_seeded_array_index_hash`. It has been shipped to Node.js v25, v24, v22, and v20 via the March 2026 security release. Upgrade now to to protect your applications from this vulnerability!

030

Node.js @nodejs.org · 25/03/2026

With a security release deadline to meet, we interleaved the hash exploration, statistical evaluation, V8 implementation, and performance testing during the development. More details in the blog post.

130

Node.js @nodejs.org · 25/03/2026

We identified the vulnerable code paths across V8, refactored to improve efficiency in seed accesses, and implemented the new hash both in runtime C++ and the JIT compiler. Preliminary testing in the classic JavaScript benchmarks showed no noticeable regressions.

130

Node.js @nodejs.org · 25/03/2026

This is bijective, efficiently invertible, and the runtime gets to hold the randomly generated keys (multipliers) for security. It fits our threat model, where the adversary cannot see the seed or observe the hash output, and only has a limited attack budget per request.

130

Node.js @nodejs.org · 25/03/2026

In this construction, xorshift propagates info downward, while multiply propagates info upward through carries. They're non-linear in each other's algebra, so the combination breaks the patterns each one preserves.

130

Node.js @nodejs.org · 25/03/2026

To address this, we designed a hash that alternates between xorshift and multiply with randomly generated multipliers. This descends from a family of mixers widely used in the industry. You can find cousins of it in Java's SplittableRandom, MurmurHash3's finalizer, and many others.

130

Node.js @nodejs.org · 25/03/2026

In CVE-2026-21717, the root cause lied in the unseeded hash V8 used for integer-looking strings, which needs to be quickly reversible to the original integer to maintain V8's performance optimizations. This poses a unique challenge not present in typical string hashing.

130

Node.js @nodejs.org · 25/03/2026

HashDoS occurs when an attacker paralyzes a server by sending a small amount of data that causes a huge amount of collisions in the server's hash tables. The standard mitigation is to use a seeded hash, with the seed randomly generated at startup to make the collisions unpredictable.

160

Node.js @nodejs.org · 25/03/2026

Can a hash be both HashDoS resistant *and* quickly reversible? That's the puzzle we had to tackle in V8 for the March 2026 Node.js security release. For details, check out our blog post (with the math for the curious!). For a quick overview, 🧵 below nodejs.org/en/blog/vuln...

nodejs.org

Node.js — Developing a minimally HashDoS resistant, yet quickly reversible integer hash for V8

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

1242

Node.js @nodejs.org · 17/03/2026

⚠️ Security release pre-alert: We will release new versions of 20, 22, 24, 25 release lines on or shortly after 24th March, 2026 in order to address: * 2 high severity issues * 5 medium severity issues * 2 low severity issues nodejs.org/en/blog/vuln...

nodejs.org

Node.js — Tuesday, March 24, 2026 Security Releases

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

0426

Reposted by Node.js

Antoine du Hamel @aduh95.bsky.social · 11/03/2026

Node.js 25.8.1 is out, fixing a Yargs 17 compatibility issue. Full changelog and download links at nodejs.org/en/blog/rele...

nodejs.org

0184

Node.js @nodejs.org · 10/03/2026

Node.js is moving to one major release per year starting with Node 27! 🚀 ✅ Simpler: Every release becomes LTS. ✅ Predictable: Version numbers now align with the year. ✅ New: A 6-month Alpha channel for early testing. bit.ly/4rnosLg

nodejs.org

Node.js — Evolving the Node.js Release Schedule

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

423360