NODEJS-27.0.0-ALPHA.0.0.0 release notes and known issues

Summary

Notable Changes V8 15.6 The V8 engine is updated to version 15.6.75.13, up from 14.6 in Node.js 26. Highlights: New language features enabled by default: Math.sumPrecise() , Intl.Locale.prototype.variants , Iterator.prototype.join() , Iterator.prototype.includes() , Iterator.zip() and Iterator.zipKeyed() . Experimental features behind flags: import defer ( --js-defer-import-eval ), Immutable ArrayBuffer ( --js-immutable-arraybuffer ) and RegExp buffer boundaries ( --js-regexp-buffer-boundaries ). Memory: when --max-old-space-size is not set, the default heap size limit is now half of the physical memory clamped between 256 MB and 4 GB, and memory held by Buffer and ArrayBuffer instances now counts toward the heap limit. Applications that relied on the previous defaults should set --max-old-space-size explicitly. Serialization: v8.serialize() , structuredClone() and postMessage() use a new format that older Node.js releases cannot read. v8.cachedDataVersionTag() and the compile cache also change on every Node.js patch of V8, not only on V8 version changes. Observable behavior changes: Math methods now use LLVM's libm and may differ in the last bit; Math.random() sequences change for a given --random-seed ; error.stack is no longer looked up through the prototype chain; await incurs fewer microtasks; Array.prototype.sort() uses PowerSort for large arrays and remains stable. Heap snapshots include internal objects, numeric values and full script sources. Taking one takes about twice as long and the file is about twice as large. WebAssembly: asm.js is no longer compiled to WebAssembly, and the --experimental-wasm-<name> flags are renamed --wasm-<name> . A full changelog of the V8 changes between 14.6 and 15.6 will be shared soon. Contributed by Joyee Cheung in #65161 , #66537 and #66601 . Other notable changes [ 21cfb2a4ad ] - (SEMVER-MAJOR) build : remove the bundled FIPS provider build (Filip Skokan) #64777 [ 34e3b90621 ] - (SEMVER-MAJOR) build : require OpenSSL 3 or later (Filip Skokan) #64777 [ c362db6e24 ] - (SEMVER-MAJOR) build : downgrade Intel macOS support to experimental (Antoine du Hamel) #65427 [ fb8d52d75a ] - (SEMVER-MAJOR) crypto : move DEP0093 to End-of-Life (Filip Skokan) #64777 [ 8be36fb494 ] - (SEMVER-MAJOR) crypto : remove legacy OpenSSL code paths (Filip Skokan) #64777 [ 718f044f07 ] - (SEMVER-MAJOR) crypto : validate digest output encodings (Filip Skokan) #66247 [ 6b8001d219 ] - (SEMVER-MAJOR) crypto : validate update input encodings (Filip Skokan) #66247 [ 127f79a911 ] - (SEMVER-MAJOR) crypto : validate inputEncoding in Cipher/Decipher update (Maruthan G) #66247 [ b116861e88 ] - (SEMVER-MAJOR) crypto : move DEP0198 to End-of-Life (Filip Skokan) #64000 [ 4d09c04253 ] - (SEMVER-MAJOR) crypto : move DEP0203 and DEP0204 to End-of-Life (Filip Skokan) #63188 [ 9d50432837 ] - (SEMVER-MAJOR) crypto : reject resizable backing stores in Web Crypto buffer parameters (Filip Skokan) #63925 [ 63907e1018 ] - (SEMVER-MAJOR) crypto : throw on uninitialized DH computeSecret (Filip Skokan) #63922 [ 463e56fb00 ] - (SEMVER-MAJOR) crypto : runtime-deprecate calling Hmac.digest() more than once (Madelyn) #63624 [ a2cd8aa883 ] - (SEMVER-MAJOR) crypto,https,tls : end OpenSSL engine support (Filip Skokan) #64777 [ 3983092f63 ] - (SEMVER-MAJOR) deps : update archs files for openssl-4.1.0 (Node.js GitHub Bot) #66971 [ 79239a48f1 ] - (SEMVER-MAJOR) deps : upgrade openssl sources to openssl-4.1.0 (Node.js GitHub Bot) #66971 [ 85bfe9a938 ] - (SEMVER-MAJOR) deps : remove ncrypto legacy OpenSSL backend (Filip Skokan) #64777 [ 826df076a3 ] - (SEMVER-MAJOR) deps : update V8 to 15.6.75.13 (Joyee Cheung) #66601 [ 4eb3908d1f ] - (SEMVER-MAJOR) deps : upgrade npm to 12.1.0 (npm team) #66212 [ cba0833111 ] - (SEMVER-MAJOR) dgram : skip the custom lookup for literal IP addresses (Ruben Bridgewater) #64131 [ 54a5095764 ] - (SEMVER-MAJOR) dns : do not consult hosts file in reverse lookups (Archkon) #64268 [ efc0a14461 ] - (SEMVER-MAJOR) dns : stop us

Improvements and security content

• Notable Changes V8 15.6 The V8 engine is updated to version 15.6.75.13, up from 14.6 in Node.js 26. Highlights: New language features enabled by default: Math.sumPrecise() , Intl.Locale.prototype.variants , Iterator.prototype.join() , Iterator.prototype.includes() , Iterator.zip() and Iterator.zipKeyed() . Experimental features behind flags: import defer ( --js-defer-import-eval ), Immutable ArrayBuffer ( --js-immutable-arraybuffer ) and RegExp buffer boundaries ( --js-regexp-buffer-boundaries ). Memory: when --max-old-space-size is not set, the default heap size limit is now half of the physical memory clamped between 256 MB and 4 GB, and memory held by Buffer and ArrayBuffer instances now counts toward the heap limit. Applications that relied on the previous defaults should set --max-old-space-size explicitly. Serialization: v8.serialize() , structuredClone() and postMessage() use a new format that older Node.js releases cannot read. v8.cachedDataVersionTag() and the compile cache also change on every Node.js patch of V8, not only on V8 version changes. Observable behavior changes: Math methods now use LLVM's libm and may differ in the last bit; Math.random() sequences change for a given --random-seed ; error.stack is no longer looked up through the prototype chain; await incurs fewer microtasks; Array.prototype.sort() uses PowerSort for large arrays and remains stable. Heap snapshots include internal objects, numeric values and full script sources. Taking one takes about twice as long and the file is about twice as large. WebAssembly: asm.js is no longer compiled to WebAssembly, and the --experimental-wasm-<name> flags are renamed --wasm-<name> . A full changelog of the V8 changes between 14.6 and 15.6 will be shared soon. Contributed by Joyee Cheung in #65161 , #66537 and #66601 . Other notable changes [ 21cfb2a4ad ] - (SEMVER-MAJOR) build : remove the bundled FIPS provider build (Filip Skokan) #64777 [ 34e3b90621 ] - (SEMVER-MAJOR) build : require OpenSSL 3 or later (Filip Skokan) #64777 [ c362db6e24 ] - (SEMVER-MAJOR) build : downgrade Intel macOS support to experimental (Antoine du Hamel) #65427 [ fb8d52d75a ] - (SEMVER-MAJOR) crypto : move DEP0093 to End-of-Life (Filip Skokan) #64777 [ 8be36fb494 ] - (SEMVER-MAJOR) crypto : remove legacy OpenSSL code paths (Filip Skokan) #64777 [ 718f044f07 ] - (SEMVER-MAJOR) crypto : validate digest output encodings (Filip Skokan) #66247 [ 6b8001d219 ] - (SEMVER-MAJOR) crypto : validate update input encodings (Filip Skokan) #66247 [ 127f79a911 ] - (SEMVER-MAJOR) crypto : validate inputEncoding in Cipher/Decipher update (Maruthan G) #66247 [ b116861e88 ] - (SEMVER-MAJOR) crypto : move DEP0198 to End-of-Life (Filip Skokan) #64000 [ 4d09c04253 ] - (SEMVER-MAJOR) crypto : move DEP0203 and DEP0204 to End-of-Life (Filip Skokan) #63188 [ 9d50432837 ] - (SEMVER-MAJOR) crypto : reject resizable backing stores in Web Crypto buffer parameters (Filip Skokan) #63925 [ 63907e1018 ] - (SEMVER-MAJOR) crypto : throw on uninitialized DH computeSecret (Filip Skokan) #63922 [ 463e56fb00 ] - (SEMVER-MAJOR) crypto : runtime-deprecate calling Hmac.digest() more than once (Madelyn) #63624 [ a2cd8aa883 ] - (SEMVER-MAJOR) crypto,https,tls : end OpenSSL engine support (Filip Skokan) #64777 [ 3983092f63 ] - (SEMVER-MAJOR) deps : update archs files for openssl-4.1.0 (Node.js GitHub Bot) #66971 [ 79239a48f1 ] - (SEMVER-MAJOR) deps : upgrade openssl sources to openssl-4.1.0 (Node.js GitHub Bot) #66971 [ 85bfe9a938 ] - (SEMVER-MAJOR) deps : remove ncrypto legacy OpenSSL backend (Filip Skokan) #64777 [ 826df076a3 ] - (SEMVER-MAJOR) deps : update V8 to 15.6.75.13 (Joyee Cheung) #66601 [ 4eb3908d1f ] - (SEMVER-MAJOR) deps : upgrade npm to 12.1.0 (npm team) #66212 [ cba0833111 ] - (SEMVER-MAJOR) dgram : skip the custom lookup for literal IP addresses (Ruben Bridgewater) #64131 [ 54a5095764 ] - (SEMVER-MAJOR) dns : do not consult hosts file in reverse lookups (Archkon) #64268 [ efc0a14461 ] - (SEMVER-MAJOR) dns : stop us

Affected products and versions

Recommended action

Review the official publisher document before deployment.

Lifecycle connections

These links connect the publisher update to related Lifecycle records without treating the update publication date as an end-of-support date.

Official publisher evidence