Node is getting a built-in benchmark runner

#​640 — September 10, 2026

Read on the Web

Cloudflare Workers Gets a New, Node.js-Aligned Module Registry — Workers enabled Node.js compatibility by default last month, meaning you can use most of Node’s built-in APIs in your Workers. Now there’s an opt-in way to load modules that resolves import paths as proper URLs, bringing import.meta and Node's require(esm) rules with it.

Logan Gatlin and James Snell (Cloudflare)

Confidently Deploy and Manage Containerized Apps on Kubernetes — Join this detailed video course with Erik Reinert and learn how to deploy and manage production-grade containerized applications on Kubernetes. You'll cover infrastructure, testing, rollbacks, autoscaling and more, all before pushing your cluster to EKS.

Master.dev sponsor

📊 node:bench: Node Core Gets a Built-In Benchmark Runner — Node has had a built-in test runner for years but no benchmark runner. James's experimental node:bench module has landed on main, so expect to see it soon. It's modelled on node:test, with a node --bench CLI and JSON reporter.

James M Snell

IN BRIEF:

• Node.js v26.8.2 (Current) and v24.21.0 (LTS) are out, both including a security release of Undici that fixes several vulnerabilities, plus OpenSSL 3.5.8 and numerous tweaks and fixes.

• 🔒 Researchers at GitLab found a CVSS 10.0 sandbox escape in vm2, the widely used Node sandboxing library. The reported escape was patched in 3.11.7+, but the writeup argues vm2 shouldn't be used for genuinely untrusted code (though vm2's own docs are also honest about this).

• Zod creator Colin McDonnell has landed a change that speeds up Node's startup (by a millisecond or so, granted) by seeding V8's non-cryptographic entropy from the OS rather than OpenSSL.

• This year's TSC elections went uncontested: Matteo Collina staying Chair and Rafael Gonzaga becoming Vice-Chair.

Fuzzing the State Machines Inside My HTTP Client — A practical case for property-based testing, made by adding fast-check properties to ffetch’s 206 passing tests. Thousands of generated cases found 11 real bugs in code considered fully tested.

Gabor Koos

Add MCP Server Monitoring to Your Node.js Project — A single function call. See who is connecting, which tools drag, and the failures MCP never throws.

Sentry sponsor

📄 Is Prisma 8 Ready for Long-Lived Production Apps? – A response to community worries about Prisma 8's new migration model. Will Madden (Prisma)

📄 Containerizing and Slimming Node Apps with Paketo Buildpacks Costas Papastathis (Paketo)

📄 What await fetch() Actually Waits For Gabor Koos

🛠 Code & Tools

Rslib 1.0: A Build Tool for JavaScript Libraries and CLIs — Rspack's answer to tsup/tsdown goes 1.0 with a stable config and JS API. It can infer syntax targets from engines.node, generates declarations faster with TypeScript 7, and (experimentally) build Node SEA executables.

Chenwei Dai, Elecmonkey, et al.

vgpu: Render WebGPU Shaders in the Browser or Node.js — Provides a way to use the same shader in the browser or render headlessly with Node (to a high-resolution PNG or MP4 video). WGSL modules import and export like TypeScript does.

Vercel

MikroORM 7.2: Row Level Security, a WASM SQLite Driver, and More — A TypeScript ORM for SQL databases and MongoDB. 7.2 adds native Postgres row level security, with policies as entity metadata, plus through relations and a WASM sql.js driver (yes, you can now use MikroORM in the browser!)

Martin Adámek

Javet 6.0: A Way to Embed Node.js and V8 in Java — A Java library that embeds a real Node.js runtime (now v26) in the JVM. Java code can load npm packages, call into running Node code, and run multiple Node instances side by side. GitHub repo.

Sam Cao

eslint-plugin-regexp 3.3: ESLint Plugin for Finding Regex Mistakes — There’s a neat online demo to show off the things it can catch.

Yosuke Ota

• parse-xml 5.0 – The fast, compliant XML parser goes ESM-only. The API is unchanged and require() still works on Node 22+.

• dhcp.js 1.0 – DHCPv4 client, server, and tools for Node. We covered the explainer blog post about this project nine years ago!

• pnpm 12.4 – The fast drop-in npm replacement can now manage npm, Python, and Cargo dependencies in the same workspace.

• ✉️ Nodemailer 10.0 – The popular e-mail sending library has migrated to TypeScript with ESM and CJS builds.

• ⚠️ Fastify 5.12.2 – Includes fixes for four high-severity issues, including validation and auth bypasses.

• tinybench 6.2 – Simple, tiny and lightweight benchmarking library with precise timing.

• 🌐 supercluster 9.1 – Mapbox's fast geospatial point clustering library.

📢  Elsewhere in the ecosystem

• React 19.3 is out with stable view transitions and fragment refs, Trusted Types support, and a browser() API used via use(browser()) to let components skip server-side rendering when they need browser-only APIs.

• 📺 Microsoft released a movie-length documentary about VS Code, directed by Stefan Kingham. It covers the editor's technical roots, touching on Node's arrival on Windows and its evolution through node-webkit (now NW.js) and Electron.

• The team behind Tailwind CSS is joining Shopify, though they say "nothing changes with Tailwind CSS or any of our other open-source projects."

• 🔒 Two men have been arrested over the TeamPCP npm supply chain attacks. TeamPCP is suspected of cloning the Shai-Hulud worm, resulting in the so-called 'Mini Shai-Hulud' waves.

• 📺 How can someone actually change JavaScript? A two-minute explainer of the basics from TC39 delegate Mikhail Barash.