This repository has been archived by the owner. It is now read-only.
A fork of Node.js. Humans before technology.
Switch branches/tags
Nothing to show
Clone or download
Latest commit 45a1c8c Dec 7, 2017
Failed to load latest commit information.
.github doc: add helpful messaging to issue and PR template Sep 24, 2017
benchmark tools, benchmark: test util benchmark Dec 7, 2017
deps deps: manually add 9.x support to npm Dec 7, 2017
doc doc: util.isDeepStrictEqual returns boolean Dec 7, 2017
lib repl: avoid crashing from null and undefined errors Dec 7, 2017
rfcs rfc: establish the website team Oct 10, 2017
src http2: avoid double close Dec 7, 2017
test test: add common.projectDir Dec 7, 2017
tools doc: add license information for remark-cli Dec 7, 2017
.editorconfig tools: disallow trailing whitespace for markdown Nov 21, 2016
.eslintignore test: change tmp directories prefix Dec 7, 2017
.eslintrc.yaml tools: enable additional eslint rules Dec 7, 2017
.gitattributes src: limit .gitattributes eol to vcbuild.bat Jan 13, 2015
.gitignore build: add lint-md-build Dec 7, 2017
.mailmap doc: update AUTHORS list Sep 13, 2017
.nycrc test: exclude write-coverage from coverage report Sep 13, 2017
.remarkrc tools: use remark-preset-lint-node in .remarkrc Dec 7, 2017
.travis.yml ci: run the linter from travis in a separate job Sep 25, 2017
AUTHORS doc: update AUTHORS list Sep 13, 2017
BSDmakefile node: rename from io.js to node Aug 23, 2015 doc: document windows shell support Oct 15, 2017 doc: fix Changelog link order Dec 7, 2017 doc: make remark-lint pass Nov 18, 2017 doc: fix missing newline character Dec 7, 2017 doc: slightly relax 50 character rule Dec 7, 2017 doc: add *-inl.h include rule to C++ style guide Dec 7, 2017 doc: make remark-lint pass Nov 18, 2017
LICENSE doc: add license information for remark-cli Dec 7, 2017
Makefile build: make test-doc and lint addon docs Dec 7, 2017 doc: make remark-lint pass Nov 18, 2017 policy: add initial RFC process (#61) Sep 18, 2017 docs: add Aug 30, 2017
android-configure build: don't create directory for NDK toolchain Mar 22, 2017
common.gypi build,src: Add CloudABI as a POSIX-like runtime environment. Dec 7, 2017
configure build,src: Add CloudABI as a POSIX-like runtime environment. Dec 7, 2017
node.gyp build: add missing comma in sources list Dec 7, 2017
node.gypi build: add c++ coverage support on macOS Dec 7, 2017
vcbuild.bat build: improve `make clean` Dec 7, 2017


Build Status

(Note: Ayo.js is forked from Node.js. Currently, a lot of the documentation still points towards the Node.js repository.)

Ayo.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It uses an event-driven, non-blocking I/O model that makes it lightweight and efficient. Ayo.js, like the rest of the JavaScript implementations, benefits from the npm package ecosystem, the largest set of open source libraries in the world.

Contributions, policies, and releases are managed under an open governance model.

This project is bound by a Code of Conduct.

Table of Contents

Resources for Newcomers

Official Resources

Unofficial Resources

To be written

Release Types

The Ayo.js project maintains multiple types of releases:

  • Current: Released from active development branches of this repository, versioned by SemVer and signed by a member of the Release Team. Code for Current releases is organized in this repository by major version number. For example: v4.x. The major version number of Current releases will increment every 6 months allowing for breaking changes to be introduced. This happens in April and October every year. Current release lines beginning in October each year have a maximum support life of 8 months. Current release lines beginning in April each year will convert to LTS (see below) after 6 months and receive further support for 30 months.
  • LTS: Releases that receive Long-term Support, with a focus on stability and security. Every second Current release line (major version) will become an LTS line and receive 18 months of Active LTS support and a further 12 months of Maintenance. LTS release lines are given alphabetically ordered codenames, beginning with v4 Argon. LTS releases are less frequent and will attempt to maintain consistent major and minor version numbers, only incrementing patch version numbers. There are no breaking changes or feature additions, except in some special circumstances.
  • Nightly: Versions of code in this repository on the current Current branch, automatically built every 24-hours where changes exist. Use with caution.

More information can be found in the LTS README.


To be written

Verifying Binaries

To be written

Building Ayo.js

See for instructions on how to build Ayo.js from source. The document also contains a list of officially supported platforms.


To be written

There are no hard and fast rules to determine if a bug is worth reporting as a security issue. The general rule is any issue worth reporting must allow an attacker to compromise the confidentiality, integrity or availability of the Node.js application or its system for which the attacker does not already have the capability.

To illustrate the point, here are some examples of past issues and what the Security Reponse Team thinks of them. When in doubt, however, please do send us a report nonetheless.

Public disclosure preferred

  • #14519: Internal domain function can be used to cause segfaults. Causing program termination using either the public Javascript APIs or the private bindings layer APIs requires the ability to execute arbitrary Javascript code, which is already the highest level of privilege possible.

  • #12141: buffer: zero fill Buffer(num) by default. The buffer constructor behaviour was documented, but found to be prone to mis-use. It has since been changed, but despite much debate, was not considered misuse prone enough to justify fixing in older release lines and breaking our API stability contract.

Private disclosure preferred

  • CVE-2016-7099: Fix invalid wildcard certificate validation check. This is a high severity defect that would allow a malicious TLS server to serve an invalid wildcard certificate for its hostname and be improperly validated by a Node.js client.

  • #5507: Fix a defect that makes the CacheBleed Attack possible. Many, though not all, OpenSSL vulnerabilities in the TLS/SSL protocols also effect Node.js.

  • CVE-2016-2216: Fix defects in HTTP header parsing for requests and responses that can allow response splitting. While the impact of this vulnerability is application and network dependent, it is remotely exploitable in the HTTP protocol.

When in doubt, please do send us a report.

Current Project Team Members

The Ayo.js project team is comprised of a core team, a moderation team, and various sub-teams. For more information, see

Core Team

Github Name Email Pronouns
addaleax addaleax Anna Henningsen she/her
aqrln aqrln Alexey Orlenko he/him
pup pup Olivia Hugger she/her
Qard Qard Stephen Belanger he/they
sandfox sandfox James Butler they/he
TimothyGu TimothyGu Timothy Gu he/him
varjmes varjmes James Spencer they/them

Moderation Team

Github Name Email Pronouns
AgentAntelope AgentAntelope Fell Sunderland he/him
janl janl Jan Lehnardt he/him
NoahDragon NoahDragon Abner Chou he/him
scotttrinh scotttrinh Scott Trinh he/him
siddharthkp siddharthkp Siddharth Kshetrapal he/him
SomeHats SomeHats Alex Dytrych she/they
srilq srilq Stef they/them
zkat zkat Kat Marchán they/them