Blog: add post about HashDoS fix in Mar 2026 security release#8777
Merged
joyeecheung merged 7 commits intonodejs:mainfrom Mar 25, 2026
Merged
Blog: add post about HashDoS fix in Mar 2026 security release#8777joyeecheung merged 7 commits intonodejs:mainfrom
joyeecheung merged 7 commits intonodejs:mainfrom
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
👋 Codeowner Review RequestThe following codeowners have been identified for the changed files: Team reviewers: @nodejs/nodejs-website Please review the changes when you have a chance. Thank you! 🙏 |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8777 +/- ##
=======================================
Coverage 75.28% 75.28%
=======================================
Files 105 105
Lines 9242 9242
Branches 326 326
=======================================
Hits 6958 6958
Misses 2282 2282
Partials 2 2 ☔ View full report in Codecov by Sentry. |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new vulnerability blog post explaining the V8/Node.js mitigation for CVE-2026-21717 (seeded, reversible integer hashing for array-index strings) as part of the March 2026 security release communications.
Changes:
- Introduces a new long-form MDX post detailing the HashDoS issue, threat model, hash design, evaluation, and deployment notes.
- Includes code samples, tables, and diagrams (referencing existing SVGs under
/static/images/blog/vulnerability/).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Member
|
Not a blocking thought, but I wonder if we need a different category on the blog for posts like this 🤔 I'd be worried that having posts in the vulnerabilities feed that aren't directly actionable by users might create some annoyance/fatigue if folks are using the RSS feed (or the site category) to keep updated on important releases. |
Member
Author
See details |
MattIPv4
reviewed
Mar 24, 2026
Member
Author
The recommended action is to upgrade to the new security releases, the blog post mostly just explains what's going on in the security release (or why users should/should not care about this particular vulnerability). |
Member
Author
|
Updated the escaping a bit. The math in the preview looks correct now. |
mikeesto
approved these changes
Mar 24, 2026
Member
mikeesto
left a comment
mikeesto
left a comment
There was a problem hiding this comment.
LGTM, this was very interesting to read!
avivkeller
approved these changes
Mar 25, 2026
ronag
approved these changes
Mar 25, 2026
Member
AugustinMauroy
left a comment
AugustinMauroy
left a comment
There was a problem hiding this comment.
LGTM ! that a nice post
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Validation
Related Issues
Check List
pnpm formatto ensure the code follows the style guide.pnpm testto check if all tests are passing.pnpm buildto check if the website builds without errors.