Node 27's first alpha brings breaking changes

#​646 — November 5, 2026

Read on the Web

Node.js 27 Alpha: The First Release Under Node's New Schedule — Under Node's new release model, each major release spends six months in alpha before stable release — so v27's final is due next April. Alphas are built from main with breaking changes, and are meant for library authors / testing rather than prod.

• V8 15.6 brings Math.sumPrecise(), Iterator.zip() and other iterator helpers by default, and import defer and immutable ArrayBuffers are available behind flags.

• There's a new default heap limit of half of physical memory (clamped between 256MB and 4GB), and memory held by Buffers counts toward it. If you relied on the old defaults, you can set --max-old-space-size.

• v8.serialize(), structuredClone() and postMessage() use a new format unreadable by older Nodes, so take care with mixed-version use.

• fs.glob is now implemented natively, there's an experimental net/promises API, and --allow-env joins the permission model.

• npm 12(.1) is now bundled so there are breaking changes to be aware of.

Rafael Gonzaga (Node.js Release Team)

Stop Babysitting Chats. Run Your Own Software Factory — A chat per agent, each one waiting on you. CodeAF does the middle: it splits the work, runs the parts in parallel, tests what came back, merges what passed and asks only when it must. #1 of ten coding harnesses on DeepSWE, at the lowest cost per fix.

CodeAF by AgentField AI sponsor

Notable V8 Changes from Node.js 26 to 27 — Further to the Node 27 updates above, here's a fantastic roundup of what new things V8 15.6 brings to the table for Node users. It's a big update as Node 26 uses V8 14.6.

Joyee Cheung

'Nothing Installs at Our Company Until It's a Week Old' — Bruno put a proxy between his company and npm that refuses releases under seven days old. Twelve days on, he shares the numbers, the lockfiles it broke, and some practical advice if you want to do it yourself.

Bruno Jurković

IN BRIEF:

• Express's October security roundup covers DoS fixes in body-parser and multer, plus its official line on the Brotli flaw: upgrade Node (but there's a workaround if you can't).

• Vercel builds now block known-malicious npm package versions before and during install, with no configuration needed.

• 🔒 It's a busy week for server framework security updates: Fastify 5.12.8 heads a wave of Fastify advisories including a critical proxy prefix escape, Hono 4.13.16 fixes several issues, and Nuxt 4.6.4 and Nitro 2.13.6 close eleven more.

Signing and Attestations Across Package Registries — A registry-by-registry survey of what npm, PyPI, RubyGems, crates.io, Go and others sign, which produce provenance attestations, and which offer trusted publishing, concluding with a handy comparison table.

Andrew Nesbitt

💡 Related: mise now verifies npm provenance by default and pins tools it installs to the repos that built them.

Parcel 3 Alpha: The Bundler Now Rewritten in Rust — Parcel's core is now a standalone Rust binary, with builds up to 100x faster on a large monorepo as a result. Plugins can be written in Rust, Go, Swift or C, or in JS/TS on a custom runtime, and there's HMR for Node targets.

Devon Govett

📄 Fuzzers vs. AI: Six Months of Hunting V8 Bugs – Fuzzilli and the BigSleep LLM agent compared on real production counts. Google Project Zero

📄 No, npm, estee Is Not a Typo of testem – On npm's typosquat heuristic and the math of four-letter names. Shane Friedman

🛠 Code & Tools

Wiki.js 3: A Modern Wiki App Built on Node — A mature project packed with features and an ecosystem of modules to integrate with other systems. Note that it's AGPL licensed. GitHub repo.

Requarks

Should You Use a Log or a Metric? — Learn when to reach for a log and when for a metric, with one signup handler as the example. Read the post.

Sentry sponsor

Postgres.js 4.0: A Ground-Up Rewrite of the Popular Postgres Client — The public API is largely unchanged, but the rewrite gains a scheduler that stops fast queries waiting behind slow ones, AbortSignal support, and more. It's ESM-only and param typing has changed, so the upgrade guide is a must-read for users.

Rasmus Porsager

NestJS 12.3: A Native node:http Platform Adapter — The server framework has long sat on top of Express or Fastify. A third adapter now runs on node:http, with Express-style request helpers but no Express dependency.

NestJS

jsdom 31.0: A New CSS Engine and a Switch to @napi-rs/canvas — The pure-JS DOM behind countless test suites gains an integrated CSS implementation (supporting cascade layers, nesting, and @scope), swaps canvas for @napi-rs/canvas, and pauses parsing at blocking scripts.

Domenic Denicola et al.

Vitest 5.1: Run Only the Tests Your Last Change Affected — An experimental --since-last-run flag records which files each test loaded and reruns only what your edits touched, with no Git involved.

Vitest Team

Nitro v3 Reaches Release Candidate — The server toolkit under Nuxt and friends gets a frozen API, an install a fraction of v2's size, Vitest-based route testing, and an experimental nitro serve that runs your source in production with no build step.

Pooya Parsa (UnJS)

• ora 10 – The elegant terminal spinner (above) now requires Node 22 and erases only its own frame, leaving your program's output intact.

• Vite+ 1.5 – VoidZero's all-in-one toolchain adds a node --import vite-plus/register hook so the built-in test runner, AVA or NODE_OPTIONS can run TypeScript through its loader.

• Got 16.2 – Sindre Sorhus's "human-friendly" HTTP request library. .json() now accepts a Standard Schema validator (Zod, Valibot, ArkType) so responses are validated and typed in one call.

• fast-json-stringify 7.3 – Fastify's serializer gains an option to lean on V8's new JSON.stringify fast path (in Node 25+) for double the throughput.

• express-fileupload 1.6 – Fixes a ReDoS in its Content-Type check where a run of semicolons could stall the event loop.

• marked-terminal 8.0 – Render Markdown in the terminal. A TypeScript rewrite with a new mt CLI and support for images via the Kitty and iTerm2 graphics protocols.

• Koa 3.3 – A hardening-flavored minor for the Express successor.