--- title: "22 Node, Bun and Deno stacks benchmarked" publication: "Node Weekly" issue: 647 published_at: "2026-11-12" canonical_url: "https://nodeweekly.com/issues/647" --- Plus Node's security releases, experimental 'green threads' for Node, and how X is rebuilding its web app on Fastify. #​647 — November 12, 2026 [Read on the Web](https://nodeweekly.com/issues/647) Together with [![Sentry logo\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,e_trim,w_350,h_100/e_make_transparent/co_white,e_outline:7/xdmchdxkka938lxfr86f.png)](https://sentry.io/resources/changelog-live/?utm_source=nodeweekly&utm_medium=paid-community&utm_campaign=brand-fy27q4-changeloglive&utm_content=newsletter-primary-register) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/pyetbikxg73hznqspgx3.jpg)](https://github.com/nodejs/node/pull/67288) [An Experimental 'Green Threads' Implementation for Node](https://github.com/nodejs/node/pull/67288) — James has opened a PR that adds a new, lightweight kind of worker that shares a small pool of OS threads, with each worker getting its own V8 isolate (but no Node APIs). His numbers show a thousand of them using about 1GB of memory vs 6.7GB for regular worker threads. Early days, but a promising idea that deserves feedback. James M Snell [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/d695db78.png)](https://sentry.io/resources/changelog-live/?utm_source=nodeweekly&utm_medium=paid-community&utm_campaign=brand-fy27q4-changeloglive&utm_content=newsletter-primary-register) [Debug Errors and Agents Faster: Sentry Changelog Live](https://sentry.io/resources/changelog-live/?utm_source=nodeweekly&utm_medium=paid-community&utm_campaign=brand-fy27q4-changeloglive&utm_content=newsletter-primary-register) — A walkthrough of what’s new for debugging errors and performance issues, including fixing production bugs with Seer and tracing the agents you build. Live Q&A. Nov 18, 10am PT. [Save your spot](https://sentry.io/resources/changelog-live/?utm_source=nodeweekly&utm_medium=paid-community&utm_campaign=brand-fy27q4-changeloglive&utm_content=newsletter-primary-register). Sentry sponsor 🔒 [This Week's Node.js Security Releases](https://nodejs.org/en/blog/vulnerability/november-2026-security-releases) — Node [v26.13.1](https://nodejs.org/en/blog/release/v26.13.1), [v24.22.3](https://nodejs.org/en/blog/release/v24.22.3) and [v22.23.5](https://nodejs.org/en/blog/release/v22.23.5) patch a lot of HTTP/2 and TLS flaws, plus others in `zlib` and the permission model (seven are rated 'high' in severity). The worst bug can allow a remote client to read memory belonging to other connections. v26 and v24 also get [last week's Undici fixes](https://github.com/nodejs/undici/releases/tag/v8.12.4). The Node.js Project 🤖 Five of the bugs were reported by Chris Rohlf _"in collaboration with Claude and Anthropic Research"_, with another credited to Trail of Bits (OpenAI). [What's New in Node.js 27](https://nodejsdesignpatterns.com/blog/whats-new-in-nodejs-27/) — The co-author of _Node.js Design Patterns_ has put together an example-led tour of the latest (alpha) Node release, going from the new iterator helpers and promise-based `node:net/promises` API to the now-unflagged virtual file system, plus the [v27 breaking changes](https://nodejsdesignpatterns.com/blog/whats-new-in-nodejs-27/#heads-up-nodejs-27-breaking-changes) to get prepared for. Luciano Mammino **IN BRIEF:** - The browser-style [Web Worker API](https://github.com/nodejs/node/pull/65323) is now enabled by default on Node's `main` branch, so expect it in a future Node 27 alpha release. - Sadly, JavaScript function hosting platform [_Val Town_ is winding down](https://blog.val.town/winding-down). Tom MacWright, who advocated for its move to Deno (from `vm2`), [wrote this week about that choice](https://macwright.com/2026/11/09/deno-security-model) saying Deno's sandbox never let them down. - Netlify has introduced [Netlify Server](https://www.netlify.com/blog/introducing-netlify-server/), a long-running Node-powered backend process for WebSockets and in-memory state, now in early access. - An open PR [proposes a built-in `node:yaml` module](https://github.com/nodejs/node/pull/67157) for parsing YAML. - 📊 The [State of JavaScript 2026 survey is now open](https://survey.devographics.com/en-US/survey/state-of-js/2026) to take. [How X is Rebuilding Its Web App on Fastify and Node 26](https://blog.x.com/en/engineering/rebuilding-the-global-town-square-from-scratch) — X is replacing three servers with one built on Fastify and Platformatic Watt, running worker threads on Node 26. Yagiz covers the streaming architecture, the event loop stalls they had to fix, and how it's making X faster on the Web. Yagiz Nizipli (X Engineering) [Keep Your CI Workflow While Upgrading the Runner at Half the Cost](https://www.warpbuild.com/start?utm_source=cooperpress&utm_medium=newsletter&utm_campaign=h2-2026&utm_content=nodeweekly-2026-11-12) — Switch to a WarpBuild runner in your Node job and see faster builds. Try it with $50 in free credits using`START50`. WarpBuild sponsor [A Malicious npm Release, Published via Trusted Publishing](https://socket.dev/blog/bee-js-compromise) — A tour of the process and code behind the recent hijacking of Ethersphere's `bee-js` release process and how a backdoored version was published with valid provenance. Socket Research Team [Your JS Error Is Lying to You](https://blog.gaborkoos.com/posts/2026-11-12-Your-JS-Error-Is-Lying-to-You/) — If you've ever seen `"err":{}` logged for an error that definitely had a message, Gábor's look into what an `Error` loses between creation and the log line could be helpful. Gábor Koós 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/h8j5savawaakzrkz99in.jpg)](https://forges.link/) [forges: One Client for GitHub, GitLab and Other Git Forges](https://forges.link/) — From Nuxt's lead maintainer, this is a single typed client for working with issues, PRs, notifications, checks and webhooks across GitHub, GitLab, Bitbucket, Codeberg, Gitea, Azure DevOps and more. Daniel Roe [AWS Emulator: An _Official_ Local Emulator for AWS APIs](https://github.com/aws/aws-emulator) — It's built in Rust, but there's now an officially supported way to point your AWS SDK or CLI at a local endpoint covering hundreds of its service interfaces. In [the release post](https://aws.amazon.com/blogs/aws-insights/better-feedback-for-building-with-agents/), Amazon suggests it's largely aimed at agents, while [also revealing](https://www.aboutamazon.com/news/aws/how-autonomous-ai-agents-built-aws-emulator) the emulator itself was built with agents (and how). Amazon Web Services [chrome-capture: Record a Chrome Tab at 60 FPS to MP4](https://github.com/paulirish/chrome-capture) — A neat, compact tool you can run with `npx` to record a Chrome 153+ tab at high quality to an MP4 file with no `ffmpeg` needed. Paul Irish - [Playwright 1.65](https://github.com/microsoft/playwright/releases/tag/v1.65.0) – Microsoft's browser automation library. Its test runner can now run under Bun too (with a few caveats), and there are a few potentially breaking changes for existing users who upgrade… - [vlt 1.7](https://vlt.io/blog/vlt-1-7) – The package manager adds `vlt deploy` for copying a workspace and production dependencies into a standalone folder, and now pins git dependencies to a commit. - [Postgres.js 4.1](https://github.com/porsager/postgres/releases/tag/v4.1.0) – Follows the recent [big 4.0 release](https://github.com/porsager/postgres/releases/tag/v4.0.0) with `sql.batch()`, a `query_timeout` option, and restored Node 18 support. 📰 Classifieds ⏱️ JSON in Postgres: still fast at 1M rows? [ExoBench benchmarks your query at scale](https://exobench.ai/jsonb-at-scale?utm_source=nodeweekly&utm_medium=newsletter&utm_campaign=nw-2026-11-12-classified), from Claude or Cursor. Now in preview. --- 🔓 Your auth validates once at login. After that, a stolen cookie works from anywhere. [Fingerprint](https://fingerprint.com/use-cases/account-takeover/?utm_source=NodeWeekly111026&utm_medium=newsletter) catches it. [Try it free](https://fingerprint.com/use-cases/account-takeover/?utm_source=NodeWeekly111026&utm_medium=newsletter). 📊 22 JavaScript Stack Combos Benchmarked [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/eneurpfovmek9rkeielf.jpg)](https://www.youtube.com/watch?v=zDw_DxM5GlI) [▶ I Tested Every JavaScript Runtime](https://www.youtube.com/watch?v=zDw_DxM5GlI) — A fun benchmark of the same Postgres-backed API app running on Node, Bun and Deno using each of their popular frameworks. In his tests, runtime choice made a bigger difference than framework choice. [The code and full results](https://github.com/arjaythedev/js-runtimes-benchmark) are on GitHub too. Arjay McCandless **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).