4 stories
CVE-2026-111497 (CVSS 9.2) lets a crafted Brotli stream trigger an out-of-bounds write, and it works in both directions: a malicious server can hit a client, and a malicious client can hit a server.
The thread argued about the name. Whether HTTP is really exposed turned out to depend on one setting.
The top HN threads: facts from the discussions, both sides, insider voices. Email, Telegram, or RSS.
Ant is a solo-built JavaScript runtime and ecosystem: an engine, a package registry, sandboxing and even a desktop-app layer, pitched as near-V8 speed in a fraction of the download size of Node or Deno.
The Show HN thread pushed back on both fronts: an outside benchmark project contradicting the speed claim, and a GitHub issue tying the 'from-scratch' engine to an existing AGPL codebase, plus blunt questions about who's behind the project and its unfinished company site.
Deno 2.9 halves cold start to 17.3 ms, pushes one realworld HTTP benchmark to 72.4k req/s, and adds `deno desktop` — point it at a web app and it auto-detects the framework, then cross-compiles to Windows, macOS and Linux from one machine.
A former Deno engineer says abundant AI access let the team finally crack Node's event-loop ordering, while it 'sent Bun off the rails.' A longtime supporter disagrees: he hit Node-compat regressions between minor releases and blames Claude-coauthored PRs.
Nub is a Rust binary that wires the oxc transpiler into Node through module.registerHooks() and an --import preload, so TypeScript, JSX and .env load with no build step on the runtime everyone already ships.
An ArkType maintainer says he merged a whole monorepo onto it with zero issues. But a Node internals reader flags the --require hook choice, warning it could quietly break top-level await in ESM.
