
Research
Node.js Fixes AsyncLocalStorage Crash Bug That Could Take Down Production Servers
Node.js patched a crash bug where AsyncLocalStorage could cause stack overflows to bypass error handlers and terminate production servers.
@foxssake/noray
Advanced tools
A simple connection orchestrator and relay to bulletproof connectivity for your online multiplayer games.
Forked from Natty that aims to cover an extended scope.
If you're already familiar with the topic, noray can help with NAT punchthrough.
If you're not familiar with the issue, I'd highly recommend reading Keith Johnston's article on the topic - it's very easy to follow and sums up the topic really well.
But to give you a short summary:
noray helps by orchestrating the NAT punchthrough process 🔥
Unfortunately, even NAT punchthrough is not always a viable solution, depending on your players' NAT setup.
To make sure that your players can always connect to eachother, noray can act as a relay 🔥
In essence, noray will dedicate a specific port to each player, at which others can send data to them. Any data incoming on this dedicated port will be transmitted as-is to the appropriate player.
NOTE: Relaying only supports UDP traffic.
After cloning the repository, run pnpm install to install all required packages.
noray can be configured through environment variables or a .env file. For available configuration keys and their purpose, please see the example configuration.
To run noray, use pnpm start or pnpm start:prod for production use.
Upon startup, the application will allocate all the configured ports and start
listening for incoming connections. Logs are written to stdout.
To keep things simple, data is transmitted through TCP as newline-separated strings. Each line starts with a command, a space, and the rest of the line is treated as data. Example:
connect-relay host-1
The protocol has no concept of replies, threads, correspondences or anything similar. Think of it as a dumbed-down RPC without return values.
At first, each player has to register as host ( even clients ). This is done by sending the following message to noray over TCP:
register-host
noray will reply with the host's OpenID and PrivateID ( oid and pid ):
set-oid [openid]
set-pid [privateid]
These ID's are needed for any subsequent exchanges with noray.
Don't forget to end your messages with a newline character!
To orchestrate connections, noray will need to know each host's external address. This is done by creating a UDP socket and using that to send the host's PrivateID. This operation is idempotent, so you're free to send multiple packets until you receive a reply.
Upon successful registration, the reply will be OK, otherwise it will be an
error message.
Connecting can be attempted either via NAT punchthrough or relay. Since noray has a limited amount of ports to dedicate to relays, it makes sense to prefer NAT punchthrough whenever possible.
Regardless of which approach is taken, you'll need to host's OpenID. At the moment, sharing OpenID is not taken care of, you'll need a manual solution for that.
Once you have the target's OpenID, you need to send one of the following commands, depending on the approach being taken:
connect [openid]
connect-relay [openid]
The server will reply with the same command in both cases. For NAT
punchthrough, it will reply with the target address and port ( e.g.
87.53.78.15:55759 ). For relaying, it will reply with the target port, since
the target machine will be the noray server itself.
Example responses:
connect 87.53.78.15:55759
connect-relay 49178
Note that both parties will receive the appropriate connect command. When this happens, the parties should attempt a UDP handshake with eachother.
noray is licensed under the MIT license.
FAQs
Online multiplayer orchestrator and potential game platform
We found that @foxssake/noray demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Node.js patched a crash bug where AsyncLocalStorage could cause stack overflows to bypass error handlers and terminate production servers.

Research
/Security News
A malicious Chrome extension steals newly created MEXC API keys, exfiltrates them to Telegram, and enables full account takeover with trading and withdrawal rights.

Security News
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.