Node.js

@JoyeeCheung @TechAtBloomberg 👏

This must've been one of the most challenging things I've worked on in a while. Thanks @TechAtBloomberg for sponsoring my work on this, and everyone who helped shipping a fix in time!

The fix has been merged into V8 and can be enabled via `v8_enable_seeded_array_index_hash`. It has been shipped to Node.js v25, v24, v22, and v20 via the March 2026 security release. Upgrade now to to protect your applications from this vulnerability!

With a security release deadline to meet, we interleaved the hash exploration, statistical evaluation, V8 implementation, and performance testing during the development. More details in the blog post.

Can a hash be both HashDoS resistant *and* quickly reversible? That's the puzzle we had to tackle in V8 for the March 2026 Node.js security release. For details, check out our blog post (with the math for the curious!) For a quick overview, 🧵 below nodejs.org/en/blog/vulner…

⚠️ Security releases are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines. Please see the blog post for additional details: nodejs.org/en/blog/vulner…

⚠️ Security release pre-alert: We will release new versions of 20, 22, 24, 25 release lines on or shortly after 24th March, 2026 in order to address: * 2 high severity issues * 5 medium severity issues * 2 low severity issues nodejs.org/en/blog/vulner…

Node.js 25.8.1 is out, fixing a Yargs 17 compatibility issue. 🔗 Full changelog and download links: nodejs.org/en/blog/releas…

Node.js is moving to one major release per year starting with Node 27! 🚀 ✅ Simpler: Every release becomes LTS. ✅ Predictable: Version numbers now align with the year. ✅ New: A 6-month Alpha channel for early testing. Read why we’re evolving: bit.ly/4rnosLg

Node.js v22.22.1 is out 🔥 Release notes 👇 nodejs.org/en/blog/releas…

Node.js v20.20.1 is out 🎉 This is the last planned release before v20 goes End-of-Life ❗ Release notes 👇 nodejs.org/en/blog/releas…

Announcing the @nodejs LTS Upgrade and Modernization Program! 🟢 🚀 We're helping enterprises move safely off end-of-life Node.js versions to reduce security risks. We are also excited to kick things off with our first partner, @NodeSource. Modern Node.js is safer Node.js. Check out the details on the OpenJS blog: bit.ly/3NkjelD #NodeJS #OpenSource #JavaScript #OpenJS

New @nodejs 25.8.0 release is out: nodejs.org/en/blog/releas…

Are you currently hiring for a role that includes using Node.js? Reply with a link to the opening and any relevant context. If you're not, we'd appreciate a repost for visibility 💚

Node.js release day! 🥳 Full changelog and download links for Node.js 24.14.0 and 25.7.0 here: - nodejs.org/en/blog/releas… - nodejs.org/en/blog/releas… Thank you to Antoine du Hamel and Ruy Adorno!