Issue #641: Node 26.9 turns on FFI by default

#641 — September 17, 2026

Together with

Why (and How) GitHub Ported Copilot's Runtime from Node to Rust — GitHub's Copilot runtime moved to Rust, ported in pieces behind napi-rs shims while shipping daily. Startup times and memory usage inspired the move, but the gold for porters is in the regressions they hit involving number types, || semantics, and blocking the event loop.

Stephen Toub (Microsoft)

That p99 Spike Is One Slow Analytics Query — One endpoint runs an analytics query over millions of rows, and latency spikes for everyone. TimescaleDB extends Postgres so that query returns in milliseconds at scale. Hypertables, compression, continuous aggregates. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

IN BRIEF:

Node is to get util.debounce() and util.throttle() functions, two staples of utility libraries. They've landed on main for a future release.
🔒 Moment.js 2.31.0 is a key update. The date library is in 'maintenance mode', but gets 25M downloads a week, and v2.31.0 fixes a path traversal vulnerability.
The Node.js Web Team's redesigned API docs have been merged and should reach nodejs.org/api alongside a release soon.
In Node 27, the HTTP client will reject responses with more headers than request.maxHeadersCount (1000 by default right now) instead of just truncating them.

Node.js 26.9.0 (Current) Released — A reasonably significant minor release that brings a few new things to the table:

node:ffi is enabled by default (but still experimental), so you can call functions in native libraries without writing an addon.
node:bench is a new benchmarking module modeled on node:test.
Web Workers now have an experimental implementation (behind a flag), so browser-style new Worker() and postMessage, etc. can be used.
Worker threads start up to twice as fast (per initial benchmarks) and use less memory, as they now start from Node's built-in snapshot.

Antoine du Hamel (Node.js Team)

Stay Sharp in the Age of AI — Master.dev instructors build at Anthropic, OpenAI, Netflix, Google, and Stripe. Learn from them via courses, workshops, and AI learning paths. New members get $100 off a yearly membership.

Master.dev sponsor

📄 Connection Reuse is the Money – How a webhook sender cut its repeat TLS handshakes with one Undici Agent per destination. Mike Murray

📄 Email, Decoupled from Where and How – The design behind Upyo, a web-standards-based email library for Node, Deno, Bun and edge runtimes that works with many providers. Hong Minhee

📄 A Deep Dive into JavaScript Engines: Writing Code That Makes V8 Happy Audrey Doyen

📄 Five Software Engineering Roles for Working with AI Nicholas C. Zakas

📄 How to Implement a Distributed Circuit Breaker Gabor Koos

🛠 Code & Tools

Eraser Diagrams: Diagrams as Code, Minus the Layout Engine — A Node API/CLI for rendering JSON diagrams to PNG or HTML. Unlike Mermaid or D2, there's no auto-layout engine, so you (or your LLM!) get to control just where things go, while connection routing, icons and styling are handled for you.

Eraser

@platformatic/memcached: A Faster memcached Client — A zero-dependency memcached client built on the modern meta protocol, pipelining over a single connection. Claims to be "roughly 3x" the speed of alternatives.

Matteo Collina (Platformatic)

jsdom 30.1: The Release That's 'Feeling the AGI' — The pure-JS DOM implementation gets faster DOM construction, mutations, getComputedStyle() and event dispatch, plus lower memory use. Much of it came from Scott's Codex-assisted PRs, which Domenic praises for being carefully curated.

Domenic Denicola and Scott Cooper

XO 5.0 – The zero-config ESLint wrapper now lints package.json files and enforces import file extensions in TypeScript.
officeParser 8.0 – Parse Office files (docx, pptx, xlsx, etc.) and PDFs into an AST. Now with a rewritten PDF extractor.
oclif 6.0 – Salesforce's framework for building Node CLIs drops support for installing legacy plugins.
pg-boss 12.33 – The Postgres-backed job queue adds a TestClock so tests needn't wait on timers.
Aedes 1.2 – Barebone MQTT broker that runs on any stream server.
🔒 Express 4.22.3 – A security release for those on Express 4.

📰 Classifieds

⚡ Zuplo puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. Try it free.

🛡️ Not all bots deserve blocking. Fingerprint Bot Detection stops content scrapers while letting legit AI agents through. Try for free.

🎟️ Join us at Supabase Select on October 2. Bring your hardest questions to the engineers building Supabase at the Ask Supabase booth. Apply to attend with 25% off: SUPAWEEKLY.

📢 Elsewhere in the ecosystem

npmchart.com (above) is a new option for tracking download trends and repo activity of npm packages. Here's the chart for express, for example.
A review of sixteen weeks of package manager releases across ecosystems finds similar new defences rolling out, like cooldowns, blocking install scripts (as in npm 12), and publish-time scans, which npm has done since July.
Those npm 12 defaults won't reach current Node lines, though. Last month, the Release WG decided npm 12 is "far too disruptive" for Node 22, 24 or 26, so it'll arrive in Node 27.
GitHub Actions has a new cache-mode setting to limit cache access per workflow or job, a defence against the kind of cache poisoning that compromised TanStack's npm packages in May.