2026-10-28, Version 27.0.0-alpha.0.0.0 (Alpha)

Notable changes:

async_hooks:
  * (SEMVER-MAJOR) remove legacy AsyncLocalStorage implementation (Matteo Collina) #63641
benchmark:
  * (SEMVER-MAJOR) protect against accidental fork bomb (James M Snell) #66132
build:
  * (SEMVER-MAJOR) remove the bundled FIPS provider build (Filip Skokan) #64777
  * (SEMVER-MAJOR) require OpenSSL 3 or later (Filip Skokan) #64777
  * (SEMVER-MAJOR) downgrade Intel macOS support to experimental (Antoine du Hamel) #65427
crypto:
  * (SEMVER-MAJOR) move DEP0093 to End-of-Life (Filip Skokan) #64777
  * (SEMVER-MAJOR) remove legacy OpenSSL code paths (Filip Skokan) #64777
  * (SEMVER-MAJOR) validate digest output encodings (Filip Skokan) #66247
  * (SEMVER-MAJOR) validate update input encodings (Filip Skokan) #66247
  * (SEMVER-MAJOR) validate inputEncoding in Cipher/Decipher update (Maruthan G) #66247
  * (SEMVER-MAJOR) move DEP0198 to End-of-Life (Filip Skokan) #64000
  * (SEMVER-MAJOR) move DEP0203 and DEP0204 to End-of-Life (Filip Skokan) #63188
  * (SEMVER-MAJOR) reject resizable backing stores in Web Crypto buffer parameters (Filip Skokan) #63925
  * (SEMVER-MAJOR) throw on uninitialized DH computeSecret (Filip Skokan) #63922
  * (SEMVER-MAJOR) runtime-deprecate calling Hmac.digest() more than once (Madelyn) #63624
crypto,https,tls:
  * (SEMVER-MAJOR) end OpenSSL engine support (Filip Skokan) #64777
deps:
  * (SEMVER-MAJOR) update archs files for openssl-4.1.0 (Node.js GitHub Bot) #66971
  * (SEMVER-MAJOR) upgrade openssl sources to openssl-4.1.0 (Node.js GitHub Bot) #66971
  * (SEMVER-MAJOR) remove ncrypto legacy OpenSSL backend (Filip Skokan) #64777
  * (SEMVER-MAJOR) update V8 to 15.6.75.13 (Joyee Cheung) #66601
  * (SEMVER-MAJOR) update V8 to 15.5.35.20 (Joyee Cheung) #66537
  * (SEMVER-MAJOR) update V8 to 15.2.124.38 (Joyee Cheung) #65161
  * (SEMVER-MAJOR) upgrade npm to 12.1.0 (npm team) #66212
dgram:
  * (SEMVER-MAJOR) skip the custom lookup for literal IP addresses (Ruben Bridgewater) #64131
dns:
  * (SEMVER-MAJOR) do not consult hosts file in reverse lookups (Archkon) #64268
  * (SEMVER-MAJOR) stop using deprecated functions in `SetServers` (Antoine du Hamel) #64356
doc:
  * (SEMVER-MAJOR) remove OpenSSL 1.x references (Filip Skokan) #64777
  * (SEMVER-MAJOR) update Node.js 27 official binary toolchains (Richard Lau) #66377
domain:
  * (SEMVER-MAJOR) runtime-deprecate the module (Matteo Collina) #65074
  * (SEMVER-MAJOR) port to AsyncLocalStorage (Matteo Collina) #61095
fs:
  * (SEMVER-MAJOR) implement glob natively (Aviv Keller) #65392
  * (SEMVER-MAJOR) return Buffer from mkdtemp when prefix is a Buffer (Hamid Reza Ghavami) #64397
http:
  * (SEMVER-MAJOR) reject responses exceeding header limit (Matteo Collina) #65010
  * (SEMVER-MAJOR) runtime deprecate instantiating without new (Yagiz Nizipli) #64853
  * (SEMVER-MAJOR) increase keepAliveTimeout default to 65 seconds (Tim Perry) #62782
  * (SEMVER-MAJOR) make req.headers have a null prototype (Matteo Collina) #62900
  * (SEMVER-MAJOR) reject addTrailers after finish (Ryuhei Shima) #62832
http2:
  * (SEMVER-MAJOR) increase default window sizes (Matteo Collina) #64623
lib:
  * (SEMVER-MAJOR) deprecate _http_* (Sebastian Beltran) #58535
  * (SEMVER-MAJOR) insert argv[0] at argv[1] in setDeserializeMainFunction (Daijiro Wachi) #62928
  * (SEMVER-MAJOR) use `Object.freeze` to avoid defensive cloning in `SourceMap` (Daijiro Wachi) #62830
  * (SEMVER-MAJOR) reject SharedArrayBuffer in Blob constructor per spec (Ali Hassan) #63046
lib,src:
  * (SEMVER-MAJOR) remove `--no-experimental-websocket` CLI flag (Antoine du Hamel) #65284
net:
  * (SEMVER-MAJOR) race family autoselection attempts (Matteo Collina) #66229
  * (SEMVER-MAJOR) throw on multiple listen calls (Matteo Collina) #64871
  * (SEMVER-MAJOR) runtime-deprecate Server.prototype._listen2 (Guilherme Araújo) #64794
  * (SEMVER-MAJOR) add experimental net/promises API (Ethan Arrowood) #63965
repl:
  * (SEMVER-MAJOR) use inspector over vm (Aviv Keller) #64034
src:
  * (SEMVER-MAJOR) officially deprecate `node::ObjectWrap` (Anna Henningsen) #63756
  * (SEMVER-MAJOR) merge `CreateEnvironment()` overloads (Anna Henningsen) #63596
src, test:
src,lib:
  * (SEMVER-MAJOR) add --allow-env permission (James M Snell) #66132
stream:
  * (SEMVER-MAJOR) destroy source when map iterator closes early (Y1D7NG) #64264
test:
  * (SEMVER-MAJOR) fix fs write encoding coverage (Filip Skokan) #66247
test,benchmark:
  * (SEMVER-MAJOR) drop OpenSSL 1.x-only coverage (Filip Skokan) #64777
test,tools:
  * (SEMVER-MAJOR) drop OpenSSL 1.x-era FIPS leftovers (Filip Skokan) #64777
test_runner:
  * use AsyncLocalStorage instead of async_hooks (Matteo Collina) #66795
tls:
  * (SEMVER-MAJOR) move _tls_* to end-of-life (Sebastian Beltran) #60658
zlib:
  * (SEMVER-MAJOR) convert classes to modern syntax and eol DEP0184 (Yagiz Nizipli) #64849

PR-URL: #67062

Author: RafaelGSS

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 Select a Node.js version below to view the changelog history:
 
+* [Node.js 27](doc/changelogs/CHANGELOG_V27.md) **Alpha**
 * [Node.js 26](doc/changelogs/CHANGELOG_V26.md) **Current**
 * [Node.js 25](doc/changelogs/CHANGELOG_V25.md) End-of-Life
 * [Node.js 24](doc/changelogs/CHANGELOG_V24.md) **Long Term Support**
@@ -35,12 +36,16 @@ release.
 
 <table>
 <tr>
+  <th title="Alpha"><a href="doc/changelogs/CHANGELOG_V27.md">27</a> (Alpha)</th>
   <th title="Current"><a href="doc/changelogs/CHANGELOG_V26.md">26</a> (Current)</th>
   <th title="LTS Until 2028-04"><a href="doc/changelogs/CHANGELOG_V24.md">24</a> (LTS)</th>
   <th title="LTS Until 2027-04"><a href="doc/changelogs/CHANGELOG_V22.md">22</a> (LTS)</th>
 </tr>
 <tr>
   <td valign="top">
+<b><a href="doc/changelogs/CHANGELOG_V27.md#27.0.0-alpha.0.0.0">27.0.0-alpha.0.0.0</a></b><br/>
+  </td>
+  <td valign="top">
 <b><a href="doc/changelogs/CHANGELOG_V26.md#26.12.1">26.12.1</a></b><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.12.0">26.12.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.11.1">26.11.1</a><br/>

doc/api/cli.md

@@ -194,7 +194,7 @@ directly through the process arguments.
 ### `--allow-env`
 
 <!-- YAML
-added: REPLACEME
+added: v27.0.0-alpha.0.0.0
 -->
 
 > Stability: 1.1 - Active development
@@ -1649,7 +1649,7 @@ Enable the experimental [`node:stream/iter`][] module.
 ### `--experimental-strip-private-modules`
 
 <!-- YAML
-added: REPLACEME
+added: v27.0.0-alpha.0.0.0
 -->
 
 > Stability: 1 - Experimental
@@ -2379,7 +2379,7 @@ Disable the experimental [`node:sqlite`][] module.
 <!-- YAML
 added: v26.4.0
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/66318
     description: VFS is unflagged but still experimental.
 -->
@@ -3262,7 +3262,7 @@ the threshold specified, the process will exit with code `1`.
 ### `--test-forbid-only`
 
 <!-- YAML
-added: REPLACEME
+added: v27.0.0-alpha.0.0.0
 -->
 
 Fails the test run if a test or suite is declared with `only: true`, including

doc/api/crypto.md

@@ -2290,7 +2290,7 @@ be listed in the `transferList` argument.
 <!-- YAML
 added: v15.0.0
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/63188
     description: Passing a non-extractable CryptoKey as `key` is no longer
                  supported.
@@ -2753,7 +2753,7 @@ console.log(verify.verify(publicKey, signature));
 <!-- YAML
 added: v0.1.92
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/63188
     description: Passing a CryptoKey as `privateKey` is no longer supported.
   - version: v15.0.0
@@ -2888,7 +2888,7 @@ This can be called many times with new data as it is streamed.
 <!-- YAML
 added: v0.1.92
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/63188
     description: Passing a CryptoKey as `key` is no longer supported.
   - version: v15.0.0
@@ -3668,7 +3668,7 @@ operations. The specific constants currently defined are described in
 <!-- YAML
 added: v0.1.94
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/63188
     description: Passing a CryptoKey as `key` is no longer supported.
   - version:
@@ -3784,7 +3784,7 @@ and can be transmitted with the ciphertext.
 <!-- YAML
 added: v0.1.94
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/63188
     description: Passing a CryptoKey as `key` is no longer supported.
   - version:
@@ -3969,7 +3969,7 @@ and description of each available elliptic curve.
 <!-- YAML
 added: v0.1.92
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/64000
     description: The `outputLength` option is now required for XOF
                  hash functions without default output lengths.
@@ -4080,7 +4080,7 @@ input.on('readable', () => {
 <!-- YAML
 added: v0.1.94
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/63188
     description: Passing a CryptoKey as `key` is no longer supported.
   - version: v26.0.0
@@ -4349,7 +4349,7 @@ is distinct from provider-specific URI parameters.
 <!-- YAML
 added: v11.6.0
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/63188
     description: Passing a CryptoKey as `key` is no longer supported.
   - version:
@@ -5298,7 +5298,7 @@ added:
  - v21.7.0
  - v20.12.0
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/64000
     description: The `outputLength` option is now required for XOF
                  hash functions without default output lengths.
@@ -5726,7 +5726,7 @@ suitable for HMAC or PBKDF2.
 <!-- YAML
 added: v0.11.14
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/63188
     description: Passing a CryptoKey as `privateKey` is no longer supported.
   - version:
@@ -5799,7 +5799,7 @@ attempting to use `RSA_PKCS1_PADDING` will fail.
 <!-- YAML
 added: v1.1.0
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/63188
     description: Passing a CryptoKey as `privateKey` is no longer supported.
   - version: v15.0.0
@@ -5844,7 +5844,7 @@ object, the `padding` property can be passed. Otherwise, this function uses
 <!-- YAML
 added: v1.1.0
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/63188
     description: Passing a CryptoKey as `key` is no longer supported.
   - version: v15.0.0
@@ -5889,7 +5889,7 @@ be passed instead of a public key.
 <!-- YAML
 added: v0.11.14
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/63188
     description: Passing a CryptoKey as `key` is no longer supported.
   - version:
@@ -6638,7 +6638,7 @@ disabled when Node.js was started with `--force-fips`.
 <!-- YAML
 added: v12.0.0
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/63188
     description: Passing a CryptoKey as `key` is no longer supported.
   - version:
@@ -6778,7 +6778,7 @@ not introduce timing vulnerabilities.
 <!-- YAML
 added: v12.0.0
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/63188
     description: Passing a CryptoKey as `key` is no longer supported.
   - version:

doc/api/deprecations.md

@@ -774,7 +774,7 @@ the API is not useful.
 
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/65074
     description: Runtime deprecation.
   - version:
@@ -2232,7 +2232,7 @@ or `module.exports` instead.
 
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/64777
     description: End-of-Life.
   - version: v23.0.0
@@ -2322,7 +2322,7 @@ npx codemod @nodejs/timers-deprecations
 
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/61095
     description: End-of-Life.
   - version: v10.0.0
@@ -4111,7 +4111,7 @@ that are shorter than the default authentication tag length (i.e., shorter than
 
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/64777
     description: End-of-Life.
   - version:
@@ -4135,7 +4135,7 @@ replacement API in Node.js. OpenSSL's provider model replaces engines upstream.
 
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/64849
     description: End-of-Life.
   - version: v24.0.0
@@ -4286,7 +4286,7 @@ npx codemod@latest @nodejs/repl-builtin-modules
 
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/60658
     description: End-of-Life.
   - version:
@@ -4354,7 +4354,7 @@ npx codemod@latest @nodejs/http2-priority-signaling
 
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/64853
     description: Runtime deprecation.
   - version:
@@ -4425,7 +4425,7 @@ npx codemod@latest @nodejs/types-is-native-error
 
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/64000
     description: End-of-Life.
   - version: v25.0.0
@@ -4448,7 +4448,7 @@ Creating SHAKE-128 and SHAKE-256 digests without an explicit
 
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/58535
     description: Runtime deprecation.
   - version:
@@ -4572,7 +4572,7 @@ const server = http2.createSecureServer({
 
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/63188
     description: End-of-Life.
   - version: v26.0.0
@@ -4593,7 +4593,7 @@ Passing a [`CryptoKey`][] to `node:crypto` functions is no longer supported.
 
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/63188
     description: End-of-Life.
   - version: v26.0.0
@@ -4642,7 +4642,7 @@ removed in a future version of Node.js.
 
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/63624
     description: Runtime deprecation.
   - version:
@@ -4663,7 +4663,7 @@ will throw an error in a future version.
 
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/63249
     description: Documentation-only deprecation.
 -->
@@ -4717,7 +4717,7 @@ successfully before the response closed.
 
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/64794
     description: Runtime deprecation.
   - version:

doc/api/dns.md

@@ -868,7 +868,7 @@ treated separately.
 <!-- YAML
 added: v0.1.16
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/64268
     description: Reverse lookups no longer consult hosts files.
 -->

doc/api/domain.md

@@ -3,7 +3,7 @@
 <!-- YAML
 deprecated: v1.4.2
 changes:
-  - version: REPLACEME
+  - version: v27.0.0-alpha.0.0.0
     pr-url: https://github.com/nodejs/node/pull/65074
     description: Loading the module now emits a runtime deprecation warning
                  (`DEP0032`).

doc/api/embedding.md

@@ -75,7 +75,7 @@ int main(int argc, char** argv) {
 ### Restricting access to environment variables
 
 <!-- YAML
-added: REPLACEME
+added: v27.0.0-alpha.0.0.0
 -->
 
 When the arguments passed to `node::InitializeOncePerProcess()` enable the

doc/api/errors.md

@@ -3942,7 +3942,7 @@ The native call from `process.cpuUsage` could not be processed.
 ### `ERR_CRYPTO_ENGINE_UNKNOWN`
 
 <!-- YAML
-removed: REPLACEME
+removed: v27.0.0-alpha.0.0.0
 -->
 
 An invalid crypto engine identifier was passed to