Node.js

Node.js

@nodejs.org

The Node.js JavaScript Runtime. 🐢🚀 Need help with Node.js? We've got a repo for that: https://github.com/nodejs/help

11.1K followers2 following92 posts

Node.js reposted

OpenJS Foundation
@openjsf.org

Do all security vulnerabilities need to be fixed in private? With support from the Sovereign Tech Agency, OpenJS is using @nodejs.org to research whether some vulnerabilities can be remediated faster through normal open development without increasing security risk. More: openjsf.org/blog/soverei...

Node.js reposted

OpenJS Foundation
@openjsf.org

Finding vulnerabilities is only part of the work. Maintainers still need resources to triage, patch, and ship secure releases. The new OpenJS Security Stewardship Program will fund researchers and maintainers, starting with Node.js. openjsf.org/blog/openjs-...

Node.js
@nodejs.org

Want to contribute to Node.js but don't know where to start? The Node.js Interactive Code and Learn workshop at RenderATL is this Thursday, August 13 — a hands-on session to make your first real contribution to the project.

Node.js reposted

Antoine du Hamel
@aduh95.bsky.social

📣 New Node.js release 📣 Node.js 26.7.0 is out with Perfetto tracing support, STORE loaders for private keys, and `module.register()` hooks are now disposable, plus many patches. Full changelog and download links available at nodejs.org/en/blog/rele...

nodejs.orgNode.js — Node.js 26.7.0 (Current)Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Node.js reposted

Antoine du Hamel
@aduh95.bsky.social

Node.js 26.4.0 is out with a new `node:vfs` built-in module (behind `--experimental-vfs` flag). It also adds support for package maps, and many bug fixes, including a fix for a regression shipped with last week security release. Full changelog and download links at nodejs.org/en/blog/rele...

nodejs.orgNode.js — Node.js 26.4.0 (Current)Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
Matteo Collina@nodeland.dev

npm install @platformatic/vfs When node:vfs ships in core, migrating is a one-line import change. Full blog post with all the details, code examples, and the story behind the PR: blog.platformatic.dev/why-nodejs-n...

blog.platformatic.devWhy Node.js Needs a Virtual File SystemNode.js now has a virtual filesystem. Learn why VFS matters for testing, sandboxing, Single Executable Apps, and running generated code directly in me

Node.js reposted

NodeConf.eu
@nodeconf.eu

#NodeConf EU is back! If you've been working on something worth sharing about #Node.js internals, performance, #developer experience, or anything in between, this is the stage for you! nodeconf.eu See you in Bologna! 🇮🇹

Node.js
@nodejs.org

Node.js Interactive returns at RenderATL 2026. Join maintainers, contributors, and developers for two days of talks on Node.js performance, security, AI tooling, infrastructure, and the real world challenges of running JavaScript at scale. https://bit.ly/43aFSBs

Node.js
@nodejs.org

Do you use Node.js on Alpine Linux? We are looking for volunteers to help us bring Alpine to "Tier 2" where it would be built and released through the normal CI process. If you can help, let us know: https://bit.ly/4v03NiW

bit.lyPromote Alpine Linux out of experimental to be a tier 2 platform · Issue #62764 · nodejs/nodeWhat is the problem this feature will solve? We currently have a significant number of users of Alpine Linux (Linux using musl as its libc implementation). For the direct tarballs from the unoffici...
Node.js
@nodejs.org

⚠️ Node.js 20 is officially End-of-Life. Join members of the Node.js Technical Steering Committee Matteo Collina and Marco Ippolito as we discuss how to navigate this transition safely. 📅 May 27 | 11:00 AM EST 👉 Register for the live session: https://bit.ly/4tzcAqE

Node.js
@nodejs.org

The 2026 Node.js London Collaboration Summit trip report is officially live! 🚀 We gathered 50+ contributors to discuss the biggest technical shifts coming to the runtime. Big thanks to Bloomberg for hosting! 🇬🇧 Check out the full recap and recordings here: https://bit.ly/3OHPLmz

bit.lyNode.js — Trip report: Node.js collaboration summit (2026 London)Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
Node.js
@nodejs.org

⚠️ Update: The Node.js project's security bug bounty program is being paused. Reporting remains unchanged, and so does our commitment to security. More details here: https://nodejs.org/en/blog/announcements/discontinuing-security-bug-bounties

nodejs.orgNode.js — Security Bug Bounty Program Paused Due to Loss of FundingNode.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
Node.js
@nodejs.org

Can a hash be both HashDoS resistant *and* quickly reversible? That's the puzzle we had to tackle in V8 for the March 2026 Node.js security release. For details, check out our blog post (with the math for the curious!). For a quick overview, 🧵 below nodejs.org/en/blog/vuln...

nodejs.orgNode.js — Developing a minimally HashDoS resistant, yet quickly reversible integer hash for V8Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
View full thread
Node.js
@nodejs.org

With a security release deadline to meet, we interleaved the hash exploration, statistical evaluation, V8 implementation, and performance testing during the development. More details in the blog post.

Node.js
@nodejs.org

The fix has been merged into V8 and can be enabled via `v8_enable_seeded_array_index_hash`. It has been shipped to Node.js v25, v24, v22, and v20 via the March 2026 security release. Upgrade now to to protect your applications from this vulnerability!

Node.js
@nodejs.org

Can a hash be both HashDoS resistant *and* quickly reversible? That's the puzzle we had to tackle in V8 for the March 2026 Node.js security release. For details, check out our blog post (with the math for the curious!). For a quick overview, 🧵 below nodejs.org/en/blog/vuln...

nodejs.orgNode.js — Developing a minimally HashDoS resistant, yet quickly reversible integer hash for V8Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
View full thread
Node.js
@nodejs.org

This is bijective, efficiently invertible, and the runtime gets to hold the randomly generated keys (multipliers) for security. It fits our threat model, where the adversary cannot see the seed or observe the hash output, and only has a limited attack budget per request.

Node.js
@nodejs.org

We identified the vulnerable code paths across V8, refactored to improve efficiency in seed accesses, and implemented the new hash both in runtime C++ and the JIT compiler. Preliminary testing in the classic JavaScript benchmarks showed no noticeable regressions.

Node.js
@nodejs.org

Can a hash be both HashDoS resistant *and* quickly reversible? That's the puzzle we had to tackle in V8 for the March 2026 Node.js security release. For details, check out our blog post (with the math for the curious!). For a quick overview, 🧵 below nodejs.org/en/blog/vuln...

nodejs.orgNode.js — Developing a minimally HashDoS resistant, yet quickly reversible integer hash for V8Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
View full thread
Node.js
@nodejs.org

To address this, we designed a hash that alternates between xorshift and multiply with randomly generated multipliers. This descends from a family of mixers widely used in the industry. You can find cousins of it in Java's SplittableRandom, MurmurHash3's finalizer, and many others.

Node.js
@nodejs.org

In this construction, xorshift propagates info downward, while multiply propagates info upward through carries. They're non-linear in each other's algebra, so the combination breaks the patterns each one preserves.

Node.js
@nodejs.org

Can a hash be both HashDoS resistant *and* quickly reversible? That's the puzzle we had to tackle in V8 for the March 2026 Node.js security release. For details, check out our blog post (with the math for the curious!). For a quick overview, 🧵 below nodejs.org/en/blog/vuln...

nodejs.orgNode.js — Developing a minimally HashDoS resistant, yet quickly reversible integer hash for V8Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
Node.js
@nodejs.org

HashDoS occurs when an attacker paralyzes a server by sending a small amount of data that causes a huge amount of collisions in the server's hash tables. The standard mitigation is to use a seeded hash, with the seed randomly generated at startup to make the collisions unpredictable.

Node.js
@nodejs.org

In CVE-2026-21717, the root cause lied in the unseeded hash V8 used for integer-looking strings, which needs to be quickly reversible to the original integer to maintain V8's performance optimizations. This poses a unique challenge not present in typical string hashing.

Node.js
@nodejs.org

⚠️ Security release pre-alert: We will release new versions of 20, 22, 24, 25 release lines on or shortly after 24th March, 2026 in order to address: * 2 high severity issues * 5 medium severity issues * 2 low severity issues nodejs.org/en/blog/vuln...

nodejs.orgNode.js — Tuesday, March 24, 2026 Security ReleasesNode.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.