ICYMI (and we hope you didn't): Node.js 20 went EOL last week. But you have options. Check out our EOL support: nodejs.org/en/about/eol

Node.js 26.1.0 is out, with a new `node:ffi` module, `crypto.randomUUIDv7()`, and many more features and bug fixes. Full changelog and download links: nodejs.org/en/blog/release/v…

Node.js v26.0.0 is out 💚 Temporal API enabled by default, V8 14.6, Undici 8, and key deprecations as we keep modernizing the platform. Check it out nodejs.org/en/blog/release/v…

Are you currently hiring for a role that includes using Node.js? Reply with a link to the opening and any relevant context. If you're not, we'd appreciate a repost for visibility 💚

The 2026 Node.js London Collaboration Summit trip report is officially live! 🚀 We gathered 50+ contributors to discuss the biggest technical shifts coming to the runtime. Here’s what’s on the horizon: 🗓️ Versioning Change: Starting with v27, Node.js version numbers will align with the calendar year. 🌀 New Streams API: A more efficient, unified way to handle streams using modern async iterators. 💾 Node VFS: A proposal for a native Virtual File System (node:vfs) for better SEAs and testing. ⚖️ AI Governance: Evolving our processes to handle the rise of AI-generated code and security reports. Big thanks to Bloomberg for hosting! 🇬🇧 Check out the full recap and recordings here: nodejs.org/en/blog/events/co…

Node.js 24.15.0 (LTS) is out now! 💚 nodejs.org/en/blog/release/v…

Are you currently hiring for a role that includes using Node.js? Reply with a link to the opening and any relevant context. If you're not, we'd appreciate a repost for visibility 💚

⚠️ Update: The Node.js project's security bug bounty program is being paused. Reporting remains unchanged, and so does our commitment to security. More details here: nodejs.org/en/blog/announcem…

Node.js 25.9.0 (Current) is out 💚 nodejs.org/en/blog/release/v…

The fix has been merged into V8 and can be enabled via `v8_enable_seeded_array_index_hash`. It has been shipped to Node.js v25, v24, v22, and v20 via the March 2026 security release. Upgrade now to to protect your applications from this vulnerability!

With a security release deadline to meet, we interleaved the hash exploration, statistical evaluation, V8 implementation, and performance testing during the development. More details in the blog post.

We identified the vulnerable code paths across V8, refactored to improve efficiency in seed accesses, and implemented the new hash both in runtime C++ and the JIT compiler. Preliminary testing in the classic JavaScript benchmarks showed no noticeable regressions.

This is bijective, efficiently invertible, and the runtime gets to hold the randomly generated keys (multipliers) for security. It fits our threat model, where the adversary cannot see the seed or observe the hash output, and only has a limited attack budget per request.

In this construction, xorshift propagates info downward, while multiply propagates info upward through carries. They're non-linear in each other's algebra, so the combination breaks the patterns each one preserves.

To address this, we designed a hash that alternates between xorshift and multiply with randomly generated multipliers. This descends from a family of mixers widely used in the industry. You can find cousins of it in Java's SplittableRandom, MurmurHash3's finalizer, and many others.

In CVE-2026-21717, the root cause lied in the unseeded hash V8 used for integer-looking strings, which needs to be quickly reversible to the original integer to maintain V8's performance optimizations. This poses a unique challenge not present in typical string hashing.

HashDoS occurs when an attacker paralyzes a server by sending a small amount of data that causes a huge amount of collisions in the server's hash tables. The standard mitigation is to use a seeded hash, with the seed randomly generated at startup to make the collisions unpredictable.

Can a hash be both HashDoS resistant *and* quickly reversible? That's the puzzle we had to tackle in V8 for the March 2026 Node.js security release. For details, check out our blog post (with the math for the curious!) For a quick overview, 🧵 below nodejs.org/en/blog/vulnerabi…

⚠️ Security releases are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines. Please see the blog post for additional details: nodejs.org/en/blog/vulnerabi…

⚠️ Security release pre-alert: We will release new versions of 20, 22, 24, 25 release lines on or shortly after 24th March, 2026 in order to address: * 2 high severity issues * 5 medium severity issues * 2 low severity issues nodejs.org/en/blog/vulnerabi…