Node.js Vulnerability Blog(nodejs.org)
6 points by Brysonbw | 1 comments
The Node.js blog's Vulnerabilities category page, listing 2026 security release announcements, an OpenSSL advisory assessment, and a V8 HashDoS post.
#nodejs on Hacker News
24 stories tagged nodejs, newest first.
Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more(broccoli2shell.com)
384 points by theanonymousone | 200 comments
Aikido blog post explaining CVE-2026-111497, a critical Brotli decoder out-of-bounds write affecting Node.js, Python, and HTTP libraries, with patch versions and workarounds.
Evolving Threat: http2shell is an RCE in Node, Python, and more(nitter.click)
154 points by cowlevel | 85 comments
A Nitter mirror of an Aikido Security post about http2shell, an HTTP/2-related remote code execution vulnerability affecting Node, Python and others; the page shows only a bot-check link.
Show HN: Building an LLM from Scratch in TypeScript(book.humanexperiences.io)
27 points by baraa_ | 2 comments
An online book guiding readers through building a large language model from scratch in NodeJS and TypeScript, covering dataloaders, embeddings, and attention.
In Memory of Deno(orgsoft.org)
6 points by mattvr | 0 comments
A blog post on Organic Software titled "In Memory of Deno," reflecting on the Deno JavaScript/TypeScript runtime.
Friendship ended with Deno, now Node is my best friend(dbushell.com)
304 points by ibobev | 228 comments
Blog post by David Bushell explaining his switch back from Deno to Node.js after using Node on a SvelteKit client project.
Show HN: PhreshOS – OS for Web Apps(github.com)
6 points by zouhirdx | 2 comments
GitHub repository for PhreshOS, an MIT-licensed open-source browser-based desktop system that hosts web apps as Node.js threads with built-in auth and real-time communication.
The ChatGPT/Codex app bundles a full copy of LibreOffice(simonwillison.net)
441 points by timpera | 206 comments
Short blog note by Simon Willison finding that the ChatGPT/Codex desktop app ships a 1.7GB runtime with Python, Node.js, Poppler, git and LibreOffice for skills.
Upcoming breaking changes for npm v12(github.blog)
459 points by plasma | 189 comments
GitHub Changelog post announcing upcoming breaking changes in npm version 12.
I am worried about Bun(wwj.dev)
487 points by remote-dev | 317 comments
A blog post by William Johnston explaining why, despite liking Bun as a fast Node.js alternative, he is now worried about its direction.
Show HN: Ez FFmpeg – Video editing in plain English(npmjs.com)
390 points by josharsh | 190 comments
npm package page for ezff, a CLI tool that translates plain-English commands into common ffmpeg video and audio operations using regex matching.
Show HN: I built an interactive HN Simulator(news.ysimulator.run)
460 points by johnsillings | 202 comments
HN Simulator, a Hacker News clone where users submit posts and links and all comments are instantly generated by LLMs using commenter archetypes.
Doing Rails Wrong(bananacurvingmachine.com)
324 points by treesenthusiast | 206 comments
A blog post written as a satirical dialogue about overcomplicating Rails 8 apps with Vite, Node, and npm instead of Rails' built-in tooling.
Playball – Watch MLB games from a terminal(github.com)
336 points by ohjeez | 137 comments
GitHub repository for Playball, an open-source terminal application for watching live MLB game updates from the command line.
Node.js is able to execute TypeScript files without additional configuration(nodejs.org)
396 points by steren | 224 comments
Node.js v22.18.0 LTS release notes, highlighting that TypeScript type stripping is now enabled by default.
Modern Node.js Patterns(kashw1n.com)
795 points by eustoria | 379 comments
Blog post titled "Modern Node.js Patterns for 2025" covering current Node.js practices such as ES modules, web-standard APIs, and streams.
Show HN: Draw a fish and watch it swim with the others(drawafish.com)
878 points by hallak | 224 comments
Drawafish.com is a web toy where users draw a right-facing fish on a canvas and release it to swim in a shared tank with others' drawings.
New Date("wtf") – How well do you know JavaScript's Date class?(jsdate.wtf)
363 points by OuterVale | 213 comments
An interactive quiz by samwho testing knowledge of JavaScript's Date class parsing quirks, verified on Node.js 24.4.0.
Oracle justified its JavaScript trademark with Node.js–now it wants that ignored(deno.com)
554 points by healsdata | 146 comments
Deno blog post on its legal fight to cancel Oracle's JavaScript trademark, arguing Oracle cited Node.js as use of the mark and now wants that disregarded.
Node.js adds experimental support for TypeScript(github.com)
1153 points by magnio | 528 comments
A merged GitHub pull request in the Node.js repository adding an --experimental-strip-types flag to run TypeScript files by discarding type annotations.
Show HN: From dotenv to dotenvx – better config management(dotenvx.com)
328 points by scottmotte | 191 comments
Blog post by dotenv's creator introducing dotenvx, a next-generation tool for managing environment variables and configuration, and recounting dotenv's history.
Show HN: Dropflow, a CSS layout engine for node or <canvas>(github.com)
381 points by chearon | 124 comments
GitHub repository for Dropflow, a CSS layout engine supporting CSS2 and some modern properties that renders to canvas, SVG, or PDF in Node or the browser.
Bun v0.8(bun.sh)
336 points by todsacerdoti | 140 comments
Bun v0.8.0 release blog post announcing debugger support, fetch streaming, SvelteKit support, node:tty streams, and Node.js compatibility fixes.
Ink: React for interactive command-line apps(github.com)
549 points by thunderbong | 158 comments
GitHub repository for Ink, a library that lets developers build interactive command-line apps using React components and Flexbox layout.