English
Dominic Elm
Report

Dominic Elm✓

@elmd_

Founding Engineer @boltdotnew • Lead for AI/ML and WebContainer • JS • Node.js • Rust 🦀 • WebAssembly • Deep Learning 🤖 • Amateur Athlete • Ironman • Dad

1K Following7.7K Followers21.2K Posts
  1. Dominic Elm✓@elmd_
    🚀 Thrilled to announce my interactive #WebAssembly course! Learn WebAssembly from the ground up with: 🔍 Custom-built debugger & VM 📊 Live stack & memory insights 💻 Hands-on exercises 🛠️ Build real projects Level up with WebAssembly! ✨ Link below 👇
    Download
    116028587.8K
  2. Dominic Elm✓@elmd_
    Dominic Elm
    RT @nodejs: Node.js 26 “Lithium” is now Long Term Support 🎉 v26.13.0 is out, with updates through April 2029. Heads-up for Linux users coming from an earlier LTS: libatomic may need to be installed separately.
    0308018
  3. Dominic Elm✓@elmd_
    Well, days after my post on the browser as a sandbox, there are more Wasm CVEs. Every Wasm engine has compiler bugs, browsers included. What matters is what's behind the sandbox. In a browser, it's another sandbox, and fixes ship automatically. Link to post in 🧵
    The Hacker News @TheHackersNews
    ‼️ ALERT - 2 New critical Wasmtime flaws (CVSS 9.9) could let malicious WebAssembly modules escape their sandbox. • CVE-2026-115889 Affects multiple architectures • CVE-2026-115893 ARM64-only, present since 2020 Embedded apps need rebuilding. Read ↓
    4113680
  4. The Hacker News@TheHackersNews
    ‼️ ALERT - 2 New critical Wasmtime flaws (CVSS 9.9) could let malicious WebAssembly modules escape their sandbox. • CVE-2026-115889 Affects multiple architectures • CVE-2026-115893 ARM64-only, present since 2020 Embedded apps need rebuilding. Read ↓
    2911848159.4K
  5. Dominic Elm✓@elmd_
    Posts @elmd_
    Dominic Elm @elmd_
    00092
  7. Dominic Elm✓@elmd_
    The recent CVE-2026-111497 in Node.js, where a process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code, does not affect WebContainer. Read more about it in my latest post 👇
    Dominic Elm @elmd_
    0213701
  8. Dominic Elm✓@elmd_
    ngl but this landing page looks dope af 👏
    OpenBot @OpenBot_
    this is literally all you need
    001513
  9. OpenBot✓@OpenBot_
    this is literally all you need
    Download
    394695774.9K
  11. Dominic Elm✓@elmd_
    Also curious, whats your setup? Genuinely curious.
    Wes Winder @weswinder
    genuine question who is still paying for cursor in 2026 and why? i haven't opened it in weeks i'm kinda curious what keeps people there
    101286
  12. Dominic Elm✓@elmd_
    Dominic Elm
    RT @weswinder: genuine question who is still paying for cursor in 2026 and why? i haven't opened it in weeks i'm kinda curious what keeps people there
    01022
  13. Dominic Elm✓@elmd_
    Dominic Elm
    RT @Paul_Kinlan: Read Dominic's post. (Here is mine from a while ago - The browser is an amazingly powerful sandbox, hardened over decades to run unknown and risky code as safely as possible.
    Dominic Elm @elmd_
    04029
  14. Dominic Elm✓@elmd_
    Secure sandboxes have never been more important than now.
    Dominic Elm @elmd_
    013268
  15. Dominic Elm✓@elmd_
    Dominic Elm
    RT @stackblitz: Rough week to run Node-based web apps. WebContainers are the infinitely scalable secure sandbox for Node.js. Untrusted code runs isolated in the browser, away from your OS and your servers. Same tech powering @boltdotnew Get a demo: More below 👇
    Aikido @AikidoSecurity
    ⚠️ Node.js is vulnerable to remote code execution. CVE-2026-111497 (high): A Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code. You’re exposed if your app or a library decompresses bad Brotli data (e.g. the built-in fetch(), body-parser) Aikido detects this. Patches are available.
    04021
  16. Aikido✓@AikidoSecurity
    ⚠️ Node.js is vulnerable to remote code execution. CVE-2026-111497 (high): A Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code. You’re exposed if your app or a library decompresses bad Brotli data (e.g. the built-in fetch(), body-parser) Aikido detects this. Patches are available.
    Download
    371571.2K256K
  17. Dominic Elm✓@elmd_
    Ok guys, I am switching back to @code from @cursor_ai. Cursor has way too many memory leaks especially with multiple windows open at the same time. The fact that chats are leaking is annoying and also that the UI is hella behind and that I can't use all _official_ extensions.
    106600
  18. Dominic Elm✓@elmd_
    . @cursor_ai Did you know that you're leaking a ton of data? Deleting a conversation doesn't actually clean everything up and leaves a lot of things behind in the local database as well as agent and sub-agent transcripts. Is that intentional? This really piles up over time.
    204784
  22. Dominic Elm✓@elmd_
    I am absolutely loving Claude Desktop lately. It’s gotten so much faster and with remote control and remote ssh it’s absolutely bonkers. Paired with Codex Desktop it’s so powerful.
    102366
  23. Dominic Elm✓@elmd_
    🤯 I found a Chromium bug where since Chrome 142 background-color transitions run on the GPU compositor and when a hover starts or ends the fill can be one frame out of sync with the text. This means fast hovers flicker... 😭 Thread 🧵
    Download
    109592
  24. Dominic Elm✓@elmd_
    Posts @elmd_
    This is not fixed in the latest Chromium! The workaround is to draw the hover fill as an inset box-shadow instead of a background color. Shadows always paint on the main thread, so they stay in sync with the text: ``` box-shadow: inset 0 0 0 100vmax ; transition-property: color, box-shadow; ```
    100113
  25. Dominic Elm✓@elmd_
    Posts @elmd_
    I filed an issue:
    00068
  26. Show more posts