Node.js 26 has only just become LTS, and you are not yet thinking about the next major version. Even development and maintenance staff who feel that way will find it worth looking at the changes in 27 once now. That is because the compatibility-breaking changes for 27.0.0, scheduled for April 2027, were published together at the time of the first Alpha.
On October 29, 2026, Node.js released "27.0.0-alpha.0.0.0" as the first Alpha of 27. After confirming where the Alpha stands, this article sets out the changes likely to affect business systems and web backends, based on the official release notes, the API documentation and the official blog post of November 5.
Alpha is not for production: it is a version for trying out in CI
The official blog announcement "Evolving the Node.js Release Schedule" of March 10, 2026 indicated that major versions would become annual starting with 27. The new flow is Alpha from October to March, Current from April to October, and then 30 months of LTS. For 27, the plan is 27.0.0 in April 2027, LTS in October 2027, and end of life in April 2030 (the announcement states, "This schedule is not final and may be amended.").
Compatibility-breaking changes (semver-major) are permitted in Alpha. The announcement describes Alpha as "Not intended for production use." and lists that APIs may change between versions and that the release team decides how often Alphas are released. It asks library authors to incorporate the Alpha into their CI early.
Where the Alpha is useful, and the decisions for each of versions 26, 24 and 22, are covered in our article on Node.js 24 entering maintenance and 26 becoming LTS.
Changes likely to affect business systems
The "Notable Changes" in the release notes start with the update to V8 15.6 (14.6 in 26), followed by 50 semver-major changes under "Other notable changes." From these, we selected the ones most likely to change behavior in business systems and web backends.
The HTTP server keep-alive default becomes 65 seconds
The default for keepAliveTimeout on http.Server has changed from 5 seconds to 65 seconds. The 27.0.0-alpha.0.0.0 history in the API documentation says, "the default value for http.Server.keepAliveTimeout is changed from 5 to 65 seconds."
From here on, this is the editorial team's supplementary note. If you run Node.js behind a load balancer, how connections are reused changes depending on the relationship between the idle time on the load balancer side and the time on the Node.js side. Configurations that currently match values on the assumption of 5 seconds, or that run with the default as is, should be checked against the load balancer settings before upgrading to 27. Because the same connections are kept for longer, the number of connections open at the same time may also increase.
The default heap limit grows on machines with 4GB to 15GB of memory
If --max-old-space-size is not specified, the default heap limit is half of physical memory or the cgroup (a mechanism that limits container memory) limit, kept within the range of 256MB to 4GB. According to the official blog post of November 5, 2026, "Notable V8 changes from Node.js 26 to 27 (Alpha)," it was previously half of physical memory, capped at 2GB (4GB on machines with 15GB or more). On an 8GB machine it increases from 2GB to 4GB, and on a 6GB machine from 2GB to 3GB.
Memory held by Buffer and ArrayBuffer is now counted as well. The release notes say it counts toward the "heap limit," while the blog says it counts toward "V8’s global allocation limit" and explains that garbage collection timing will change for applications that use Buffer heavily. Both ask applications that relied on the previous default to specify --max-old-space-size explicitly.
From here on, this is the editorial team's supplementary note. Services whose memory usage has been held down by the default limit may use more memory when the limit goes up. Batch jobs that handle large CSV files or images with Buffer may see their memory usage change as garbage collection timing changes. When trying 27, verify by running peak-time processing with the same memory allocation as production.
req.headers becomes an object with no prototype
The release notes say, "http: make req.headers have a null prototype," and the API documentation says of message.headers, "The object has a null prototype."
This is an editorial supplementary note. Objects with no prototype do not have methods such as hasOwnProperty. Code written like req.headers.hasOwnProperty('authorization') is expected to throw an error on 27. If you replace it with Object.hasOwn(req.headers, 'authorization'), it will work on both 26 and 27. If you write your own authentication or audit middleware, search for this and check.
Formats such as structuredClone cannot be read by older versions
v8.serialize(), structuredClone() and postMessage() use a new format. According to the official blog post of November 5, reading a value written by 27 on an older Node.js results in an "invalid or unsupported version" error. Conversely, values written by older versions can be read by 27.
This is an editorial supplementary note. In configurations that store v8.serialize() results in a cache or queue, 26 cannot read values written by 27 during a migration in which 27 and 26 run side by side. If there will be a period of mixed versions, you need a plan to either switch to a format such as JSON or upgrade the reading side to 27 before the writing side.
Other changes worth checking
- OpenSSL: The 27 Alpha bundles OpenSSL 4.1.0 (3.5.9 in 26.13.0), and building now requires OpenSSL 3 or later. Support for OpenSSL engines has ended, and the bundled FIPS provider build is also gone
- Crypto input validation: The character encoding specified for digest and update in
cryptois now validated domainmodule: A runtime deprecation warning (DEP0032) is now emitted- HTTP header limit: On the client side, when the number of response headers exceeds
maxHeadersCount, the response is now rejected withHPE_HEADER_OVERFLOWrather than truncated - npm: Bundles 12.1.0 (11.20.0 in 26.13.0)
| Change | Where the impact is likely | Where to look first |
|---|---|---|
| keepAliveTimeout default of 65 seconds | API servers behind a load balancer | Load balancer idle time, and whether server.keepAliveTimeout is set explicitly |
| Default heap limit and how Buffer is counted | Services running with 4GB to 15GB of memory, and batch jobs that handle large files | --max-old-space-size in the startup arguments, and container memory allocation |
req.headers with no prototype | Your own middleware | Calls to headers.hasOwnProperty |
If you develop on an Intel Mac
The release notes say, "build: downgrade Intel macOS support to experimental." The pull request for this change (#65427) says it would be best to stop providing official binaries for Intel macOS from 27.0.0-alpha.0.0.0 onward, and explains that Intel Mac users will have to rely on unofficial binaries. "Experimental" in BUILDING.md is also defined as a target for which the core team does not produce releases.
The distributed files match this explanation as well. In the official distribution listing (index.json), the tar for Intel macOS (osx-x64-tar) that exists for 26.13.0 is absent from 27.0.0-alpha.0.0.0, and SHASUMS256.txt does not include a darwin-x64 tar either. index.json still has a osx-x64-pkg entry, but when we extracted and examined the distributed .pkg on November 6, 2026, the node inside contained only an arm64 executable (we did not run it). Be careful not to conclude from the name alone that an Intel version is being distributed.
If you try to install the 27 Alpha on an Intel Mac with a tool that fetches the tar, such as nvm, the download may fail. If your development team still has Intel Macs, consider whether you can move development to Apple silicon Macs or Linux containers by April 2027, when 27 Current is released.
How to think about adding the 27 Alpha to CI
From here on, this is the editorial team's proposal. Keep your production version on 26 (or 24) unchanged, add one 27 Alpha to your CI tests, and treat it so that a failure does not stop the whole run. Fetch it from the official distribution source and verify it with SHASUMS256.txt.
V=v27.0.0-alpha.0.0.0
F=node-$V-linux-x64.tar.xz
curl -fsSLO https://nodejs.org/dist/$V/$F
curl -fsSL https://nodejs.org/dist/$V/SHASUMS256.txt | grep " $F\$" | sha256sum -c -
tar xf $F && export PATH="$PWD/node-$V-linux-x64/bin:$PATH"
node -v && npm testIf you record failed tests sorted by which of the changes listed above they correspond to, you can use that to estimate the workload when 27.0.0 is released. Because APIs may change between Alpha versions, recheck code fixed on the Alpha again on 27.0.0. For how to go about bulk version updates, our article on the bulk update to Node.js 22.23.4 is also a useful reference.
Even if you leave your production version as is, apply security updates separately. On November 3, 2026, Node.js gave advance notice that it would release new versions of 26.x, 24.x and 22.x on or after November 11. The highest severity is HIGH. The 27 Alpha is not listed among the targets of this notice.
Scope of verification
On October 31, 2026, we directly retrieved and checked the nodejs.org release notes "Node.js 27.0.0-alpha.0.0.0 (Alpha)," the announcement "Evolving the Node.js Release Schedule," the 27.0.0-alpha.0.0.0 API documentation (HTTP, Deprecated APIs, Domain), and the distribution listings (
index.jsonandSHASUMS256.txt) (document research). On November 6, 2026, we rechecked the same materials and confirmed that no new Alpha had been released, and we also checked the official blog post of November 5, the advance notice of the November 11 security update, the nodejs/node pull requests (#65427, #65010), andBUILDING.md. We extracted.pkgand examined only the executable file type. We have not run the 27 Alpha binaries and have not verified the actual behavior of keep-alive, the heap,req.headers, or the serialization format. ThathasOwnPropertyresults in an error is an inference from the JavaScript specification, and the relationship with load balancers and how to incorporate this into CI are the editorial team's suggestions. We have confirmed that the distribution URL in the commands above and the file used for verification exist.
For version upgrade planning for business systems running on Node.js, or for identifying the impact before migrating, please contact us through consultation on development, AI, and automation.
References
- Node.js 27.0.0-alpha.0.0.0 (Alpha)（Node.js Blog、2026-10-29）
- Evolving the Node.js Release Schedule（Node.js Blog）
- Notable V8 changes from Node.js 26 to 27 (Alpha)（Node.js Blog、2026-11-05）
- Wednesday, November 11, 2026 Security Releases（Node.js Blog）
- HTTP（Node.js v27.0.0-alpha.0.0.0 Documentation）
- Deprecated APIs（Node.js v27.0.0-alpha.0.0.0 Documentation）
- Node.js release index（index.json）
- build: downgrade Intel macOS support to experimental（nodejs/node #65427）
- http: reject responses exceeding header limit（nodejs/node #65010）
- BUILDING.md（nodejs/node、v27.0.0-alpha.0.0.0）
