Node.js 26 became LTS in late October with a security fix alongside it, while Bun announced an experimental ahead-of-time compiler and a built-in formatter that it says run Node-compatible apps; the gathered sources rely largely on Bun's own benchmarks and don't show whether Bun is displacing Node in production.

From the stories

Everything you see & hear in this video was driven by a @bunjavascript application. One MacBook, running one Bun app, poScott Hiett

Bun vs Node.js: Research comparison

Quick Verdict

Node.js spent October patching a 9.2-rated Brotli remote-code-execution bug and crowning Node 26 "Lithium" as LTS. Bun spent it shipping a built-in formatter and teasing an ahead-of-time compiler that it says runs Node apps unchanged. In the gathered evidence, Bun pitches itself as a Node-compatible drop-in rather than a separate world. Per @jarredsumner, Bun is a Node-compatible runtime, npm-compatible package manager, jest-compatible test runner and esbuild-compatible bundler (1,827 likes). A DEV Community benchmark frames it plainly: Bun 1.4 reports Node.js 26 compatibility, so for many apps switching is now a runtime swap rather than a rewrite. On raw scale, nodejs/node sits at 123,207 GitHub stars with 1,297 open issues, against oven-sh/bun at 96,523 stars and 9,693 open issues. Node's October 21 security post from @nodejs drew 12,577 likes and 1,267,279 views. The sources do not establish whether Bun is actually displacing Node in production.

Bun

Jarred Sumner posted that Bun AOT cut memory 40% and CPU 14% on an Express node:sqlite REST API, with no JIT warmup. That October 31 post drew 678 likes. On October 23 he wrote that he planned to merge AOT the following week and then test it on Claude Code, expecting 2-3x less memory and CPU (1,619 likes). He also says AOT is designed to run existing Bun and Node apps without code changes (598 likes). An earlier preview on X put concrete numbers on Claude Code's CLI with the JIT off: 24% faster startup, 48% lower memory, 46% lower CPU, and nearly 2x larger binary size, matching what the iiaku write-up separately reported (24% faster to interactive, 48% less memory, 46% less CPU). Bun's own AOT docs describe bun compile as experimental, compiling TypeScript and JavaScript to machine code at build time into a single executable that runs on machines without Bun installed, and note the compiler uses existing type annotations where present. It describes that work as still an open draft PR. These are first-party and author benchmarks. The gathered sources show AOT in testing, not shipped as the default.

The underlying Bun 1.4 release already banked large gains before AOT entered the picture. The Bun 1.4 blog post says Claude Code's production CPU usage dropped by 2x on Bun, with p99 falling from 24% to 10% and p50 from 5.8% to 2.5%, and that HTTP servers on Bun should see a 13% to 48% memory usage reduction under a benchmark of 1,000,000 requests at 64 connections. A third-party Scrydon write-up by Xavier Geerinck reports its own fleet numbers after upgrading nine Bun runtime services: average CPU fell from 18.7 to 9.4 mCPU and average container working-set memory fell 60.4%, from 754.6 to 298.5 MiB, while traced server traffic rose 27.1% with more spans at lower CPU cost. An independent Medium verification piece cross-checked Bun's memory claims and also notes the Rust port passes 99.8% of the old Zig-era test suite on Linux x64 glibc, alongside a roughly 20% binary size reduction on Linux and Windows from the rewrite.

The shipping cadence is Bun's clearest strength. @bunjavascript announced v1.4.3 on October 10, which fixed 166 issues, added bun check and cut idle CPU in servers by 67% (1,049 likes). The Bun v1.4.4 post followed on October 22 and covers Yarn Berry lockfile migration in bun install. Bun's blog index adds that v1.4.4 fixes 271 issues and ships a bun fmt that is 3x to 6x faster than oxfmt.

Practitioners mostly praise the consolidation. In the r/bun v1.4.4 thread (80 upvotes), u/Trader-One called bun fmt a major developer-experience win because you skip tool configuration. @mauricekleine is "so bullish" about collapsing a JS/TS toolchain into a single dependency. @hiettdigital ran a live show's lighting, MIDI and audio from one Bun app on one MacBook via Bun FFI (24 likes). @chenbimo argued Bun deserves runtime of the year while Node "holds steady" (25 likes).

More is announced but not yet shipped. Improved Vitest compatibility is promised for the next version (518 likes). The oven.sh careers page lists 3 on-site San Francisco roles, including Product Engineer, AI. A Strapi comparison guide adds a sharper caveat on ecosystem maturity: Bun 1.4 passes 97% of the node:http, node:fs and node:stream test suites, yet Fastify, NestJS, Datadog, New Relic and OpenTelemetry do not officially support it, even though over 75% of Node's own package surface reportedly runs fine on Bun unmodified.

The weaknesses are about trust, not speed. The r/webdev "Why is bun so disliked?" thread ran to 109 comments:

• u/josephjnk (412 upvotes) said he checks Bun's GitHub issues every time this comes up and again found a segfault reported in the previous 24 hours: "This is not stable software."
• u/crankykong (140 upvotes) is holding off because of past short-lived tech.
• u/asstaters (115 upvotes) asked whether the whole thing is "vibe coded in rust now."

That last jab tracks the ownership story. Per techietory, Anthropic acquired Bun in December 2025, and the Rust port merged in May 2026 as a single commit of over a million lines. Gaps remain: u/Alpha-Ceph (8 upvotes) is waiting on bun lint before fully migrating a pipeline. The same techietory table lists Bun with no sandbox by default. On October 31, @bunjavascript said the team is dedicating a higher share of its time to security (917 likes).

Node.js

Node.js 26 "Lithium" became LTS on October 28 with v26.13.0, supported through April 2029. The @nodejs announcement drew 2,120 likes and warned Linux users that libatomic may need a separate install. Vercel made Node 26 the default for new projects on October 29. The transition bit at least one team. In the r/node LTS thread (285 upvotes), u/sebasgarcep (145 upvotes) said a production deploy failed because a Dockerfile was pinned to LTS. The DEV Community benchmark ran Bun 1.4.3 against both Node.js 24.22 and Node.js 26.12 on one machine, testing HTTP throughput with Hono, Express and plain node:http, a real Postgres-backed API, large in-memory heaps, startup, TypeScript execution and npm installs, treating Node 26 as the current LTS baseline rather than a legacy comparison point.

Node is also changing how it ships majors. The project said, via an @openjsf retweet, that Node 26 is the final release under the twice-yearly cadence. @_rafaelgss called Node 27 Alpha the first release of the new model (250 likes). It stays Alpha until April, goes Current in 2027-04 and reaches LTS in 2027-10. It ships with V8 15.6, npm 12.1, an --allow-env permission and native fs.glob.

The October 21 security releases patched CVE-2026-111497, a Brotli decoder RCE nicknamed Node2Shell, across the 22.x, 24.x and 26.x lines. Fixed versions are 22.23.4, 24.22.1 and 26.12.1. On October 28, @TheHackersNews reported the bug had moved from proof of concept to the wild, with scanning live (855 likes). @rauchg said Vercel rolled out firewall-level mitigations ahead of the official patch (2,566 likes).

The Broccoli2Shell Hacker News submission hit 405 points and 219 comments. Commenters there and on related submissions added context:

• bmitch3020 noted the decoder also ships in curl and git, linking posts by @harrysintonen.
• sippeangelo asked whether Express 5's body-parser enables Brotli decoding by default, which would expose any endpoint using that middleware. That was posed as an open question, not a confirmed finding.

On r/homelab, u/kingdomtechgroup (272 upvotes) predicted more of these after PHP and Node landed critical bugs the same week.

Node's trust signal is incumbency. Fireship's "The runtime wars are over... and Node won" (1,214,149 views) framed Deno joining Cloudflare as the end of the runtime wars. Its top comment, "From Node to Deno to Done," has 2,900 likes. Day-to-day discussion treats Node as the default and argues about everything around it:

• In r/Backend (44 comments), u/PrimaryFamous6139 (29 upvotes) argued maintainability depends more on architecture, typing and testing than on the runtime.
• An r/javascript AskJS thread (25 comments) is about hosting, not whether to use Node at all.
• Naukri lists 48,259 Node.js vacancies.

Head-to-Head

The Bottom Line

Choose Bun if you are starting fresh and want one dependency for runtime, install, format, type-check and test, and you can absorb some churn. The appeal is real per @mauricekleine and u/Trader-One, and third-party fleet numbers like Scrydon's 60.4% average memory drop across nine services suggest the gains aren't purely vendor theater. Still, u/josephjnk's 412-upvote segfault critique, the unshipped bun lint, and Strapi's note that Fastify, NestJS, Datadog, New Relic and OpenTelemetry remain unofficially supported mean you should keep a Node fallback for critical paths. techdrifting cites Bun's own Express test at 48,243 requests per second against 25,181 for Node. It warns those are vendor numbers to treat as a ceiling, not a guarantee. A head-to-head DEV Community benchmark run independently against both Node 24.22 and Node 26.12 is the closest the evidence gets to a neutral test, covering Hono, Express, plain node:http, a Postgres-backed API, heap size, startup time, TypeScript execution and npm installs in one pass.

Choose Node.js if you need a long, predictable support window and governance outside any single company. Node 26 LTS runs through April 2029, and Vercel ships it as the default. The cost is operational: October showed you need a fast patch path, because Node2Shell went from advisory to in-the-wild scanning within a week per @TheHackersNews.

The emerging stack

The gathered evidence does not establish an emerging stack pattern. The closest signals are vendor-side. Bun's package manager page pitches bun install for projects that "Keep running your app on Node.js if you like." Sumner says Bun AOT targets existing Node apps without code changes, and Bun's own AOT docs frame bun compile as producing a single machine-code executable that runs without Bun installed, which nudges toward Bun-as-build-tool even for teams that deploy elsewhere. Tools like the Knitting shared-memory concurrency runtime (12 points on Hacker News) target Node.js, Bun and Deno at once. None of the community threads here document teams running Bun tooling on top of a Node runtime in production. That hybrid is a pitch, not an observed convergence.