NodeSource Weekly — August 4, 2026: Node.js Releases, npm Security & AI Agent Updates
👋 Welcome to the August Edition!
This week, we’re covering the latest releases, security developments, AI tooling, and community updates shaping the Node.js ecosystem.
Here’s what’s inside:
- 🟢 Node.js Updates: New releases across the 26.x, 24.x, and 22.x lines, including important security fixes and improvements to performance, testing, streams, networking, and developer tooling.
- 🎙️ NodeSource News: A new episode of Café con CVEs exploring what really happens during
npm install, how lifecycle scripts can execute code, and what changes with npm v12. - 🤖 AI Corner: Major updates across the AI ecosystem, including lower GPT-5.6 API pricing, a new stateless architecture for MCP, and Gemini agents completing web tasks directly through Chrome.
- 🌎 Community Highlights: The latest resources, conversations, milestones, and events bringing the Node.js and open-source communities together.
- 🚀 New resources from NodeSource: Including the N|Solid DevTools website, the open-source N|Solid Plugin for AI coding agents, and free expert guidance through the Node.js Upgrade Program.
Happy reading! 🚀
🟢 Last Week in Node.js
🔐 New Node.js Security Releases
The Node.js Project released security updates for the 26.x, 24.x, and 22.x release lines to address multiple vulnerabilities with a maximum severity rating of HIGH.
The releases included fixes for:
- HTTP/2 vulnerabilities that could lead to remote memory exhaustion or a heap use-after-free
- A Permission Model vulnerability that could grant access to filesystem paths outside the configured allowlist
- HTTPS Agent issues involving mTLS identity and TLS session reuse
- Vulnerabilities affecting DNS, SQLite, zlib, HTTP header limits, trace events, and diagnostic report paths
- Security-related updates to the Undici and llhttp dependencies
The fixes are available in Node.js 26.5.1, 24.18.1, and 22.23.2. Teams using affected release lines should update to the latest available version as soon as possible.
👉 Read the security announcement
View the Security Releases
🚀 Node.js 26.6.0 and 24.19.0 Released
The Node.js Project released new Current and LTS versions with improvements across testing, streams, networking, performance monitoring, TLS, and developer tooling.
Node.js 26.6.0 Introduces
getCurrentEventLoop()for FFIcontext.log()and a newtest:logevent in the test runner- The test entry file in
TestStreamevents - Performance and reliability improvements for streams, HTTP/2, QUIC, networking, and event handling
- npm 11.18.0
Node.js 24.19.0 Introduces
blob.textStream()for reading Blob content as a text stream- Stable support for
stream.compose() - Experimental text module imports through
--experimental-import-text - Caller-provided buffers for
readFile() - Configurable HTTP header-value validation
- Additional TCP keepalive controls
- Event loop delay sampling on every event loop iteration
- TLS certificate compression and negotiated TLS group reporting
🌎 Community & Events
🎙️ Café con CVEs Episode 2: What Really Happens During npm install?
Most developers think npm install simply downloads package files. However, dependencies have traditionally been able to execute code automatically during installation.
In Episode 2 of Café con CVEs, our Spanish-language security podcast, we explore:
- How
preinstall,install, andpostinstalllifecycle scripts work - Why packages use installation scripts
- How compromised dependencies can execute arbitrary code
- Why transitive dependencies increase the software supply chain attack surface
- What changes with npm v12
- Why blocking installation scripts does not eliminate every package security risk
npm v12 introduces a major security change: packages must now receive explicit approval before running installation scripts. This removes one of the most commonly abused entry points in JavaScript supply chain attacks, but it is not a complete security solution.
🎥 Watch the episode in Spanish
📖 Prefer Reading?
Explore the English companion article:
👉 Why npm install Can Execute Code and What Changes With npm v12
Learn more about the npm v12 security changes:
👉 npm v12: Install Scripts Are Not a Silver Bullet
🤖 AI Corner
Three AI developments that stood out this week:
💸 OpenAI Makes GPT-5.6 Significantly Cheaper
OpenAI reduced the API price of GPT-5.6 Luna by 80% and GPT-5.6 Terra by 20%, making agentic workflows and high-volume AI applications more economical to operate.
The new pricing is:
- GPT-5.6 Luna: $0.20 per million input tokens and $1.20 per million output tokens
- GPT-5.6 Terra: $2 per million input tokens and $12 per million output tokens
OpenAI also introduced Fast mode for GPT-5.6 Sol, delivering up to 2.5× faster responses than standard processing at twice the price, without changing the model’s intelligence.
The update reflects a broader industry shift toward optimizing not only model capability, but also the cost and speed of running AI agents in production.
🔌 MCP Introduces a Stateless Architecture
The Model Context Protocol released MCP 2026-07-28, one of its most significant specification updates since the protocol was introduced.
The new version includes:
- A stateless request-and-response architecture
- Easier deployment on serverless and edge infrastructure
- Standardized extensions for interactive MCP Apps and long-running Tasks
- Stronger OAuth 2.0 and OpenID Connect authorization
- Better compatibility with enterprise identity providers such as Okta and Microsoft Entra
Anthropic is rolling out support across Claude products. The update could make it considerably easier to build, deploy, and scale MCP servers that connect AI agents with applications, tools, and internal data.
👉 Explore the new MCP specification
🌐 Gemini Spark Can Now Perform Web Tasks Through Chrome
Google integrated Gemini Spark directly with Chrome, giving the AI agent the ability to complete multi-step web tasks using the browser.
With the user’s permission, Spark can access logged-in sessions and use saved credentials to perform tasks such as researching travel options, starting reservations, or scheduling appointments.
Google says sensitive actions, including payments, are returned to the user for confirmation. The system also includes protections designed to reduce risks from prompt-injection attacks.
Chrome automation is initially rolling out in the United States, while access to Gemini Spark is expanding to Google AI Pro subscribers in more than 160 additional countries.
👉 Explore Gemini Spark for Chrome
🚀 Featured From NodeSource
🤖 N|Solid DevTools for AI Coding Agents
We launched a new website dedicated to N|Solid developer tools, including the N|Solid Extension and the open-source N|Solid Plugin for AI coding agents.
👉 Explore the N|Solid DevTools website
🤖 Bring Production Node.js Diagnostics to Your AI Agent
The N|Solid Plugin enables AI coding agents to access and analyze real runtime data, including:
- Heap snapshots
- CPU profiles
- Runtime telemetry
- Package security insights
- Application benchmarks
It works with Claude Code, Codex CLI, OpenCode, Antigravity CLI, Pi Agent, and other supported AI coding tools.
👉 Learn more about the N|Solid Plugin
Get Started With N|Solid DevTools
🚀 Node.js Upgrade Program
Free Expert Help for Your Next Node.js Upgrade
Still running an End-of-Life version of Node.js?
The Node.js Upgrade Program, developed in partnership with the OpenJS Foundation, helps organizations migrate to supported LTS releases with free expert guidance from the Node.js ecosystem.
You can follow the step-by-step upgrade process yourself using the program's resources, or request assistance from the Upgrade Program team to help plan and execute your migration.
The program is designed to help organizations:
- ✅ Upgrade from End-of-Life Node.js versions
- ✅ Reduce security and compliance risks
- ✅ Plan migrations with confidence
- ✅ Modernize production applications
Participation is completely free for organizations.
⚡ Stay Connected
The Node.js ecosystem never stands still—and neither do we.
Subscribe to stay up to date with future editions featuring the latest Node.js releases, AI-powered developer tools, observability, security, and community news.
Have questions, feedback, or ideas for a future edition? We'd love to hear from you.
See you next month! 👋