Node.js 27 Requires OpenSSL 3 and Drops Bundled FIPS Provider

• Build requirement: the bundled FIPS provider build is removed and OpenSSL 3 or later is required (Node.js 27.0.0-alpha.0.0.0 release notes, #64777).
• Heap limit: without --max-old-space-size, the default is half of physical memory, clamped between 256 MB and 4 GB.
• Serialization: v8.serialize(), structuredClone() and postMessage() use a new format that older Node.js releases cannot read.
• V8: updated from 14.6 in Node.js 26 to 15.6.75.13.
• WebAssembly: asm.js is no longer compiled to WebAssembly, and --experimental-wasm-<name> flags are renamed --wasm-<name>.
• Security fix: CVE-2026-58042 covers large resolveAny address replies in dns (#64820).

Removed FIPS Provider Build and OpenSSL 3 Requirement #

Two SEMVER-MAJOR entries from commits 21cfb2a4ad and 34e3b90621, both by Filip Skokan under #64777, remove the bundled FIPS provider build and set the minimum at OpenSSL 3. OpenSSL 3 or later is now required. Builds that depended on the bundled provider need another source of FIPS-validated cryptography, and the notes do not describe a replacement path.

The same pull request removes the legacy OpenSSL code paths and the ncrypto legacy OpenSSL backend, and ends OpenSSL engine support in crypto, https and tls (commit a2cd8aa883). A separate entry upgrades the OpenSSL sources to openssl-4.1.0 (#66971). This suggests that the OpenSSL 3 floor is a minimum and that OpenSSL 4.1 is the bundled version, but the notes do not state which OpenSSL versions were tested against this alpha.

Several crypto APIs now validate more input. Digest output encodings and update input encodings are checked (#66247), Web Crypto rejects resizable backing stores in buffer parameters (#63925), and computeSecret on an uninitialized DH object throws (#63922). DEP0093, DEP0198, DEP0203 and DEP0204 move to End-of-Life, and calling Hmac.digest() more than once is runtime-deprecated (#63624).

Default Heap Limit Now Scales With Physical Memory #

When --max-old-space-size is not set, the default heap limit is half of physical memory, clamped between 256 MB and 4 GB. Memory held by Buffer and ArrayBuffer instances now counts toward that limit. By this rule, a host with 1 GB of physical memory gets a 512 MB limit, and any host with 8 GB or more reaches the 4 GB ceiling. set --max-old-space-size explicitly if the application relied on the earlier defaults.

Because buffer memory now counts, this suggests that a process holding large Buffers can reach the limit while its JavaScript objects are modest. The release notes do not give a threshold or an example for this case.

Heap snapshots now include internal objects, numeric values and full script sources. Taking one takes about twice as long and the file is about twice as large. This suggests that snapshot files may contain application source code and should be handled like the code they capture.

New Serialization Format Breaks Older Node.js Readers #

v8.serialize(), structuredClone() and postMessage() use a new format that older Node.js releases cannot read. Serialized data from this alpha cannot be read by older releases. This suggests that worker messages, IPC payloads or stored serialized bytes exchanged with older Node.js versions will fail unless both sides are upgraded.

v8.cachedDataVersionTag() and the compile cache change on every Node.js patch of V8, not only on V8 version changes. This suggests that cache entries built by one patch release will not match another, so caches should be rebuilt after each upgrade.

V8 15.6 Math, Stack and Microtask Behaviour Changes #

Math methods now use LLVM's libm and may differ in the last bit, and Math.random() sequences change for a given --random-seed. This suggests that tests comparing floating-point results or seeded random output against stored values will need new expectations after the upgrade.

error.stack is no longer looked up through the prototype chain, await incurs fewer microtasks, and Array.prototype.sort() uses PowerSort for large arrays while remaining stable. This suggests that code depending on the number of microtask turns or on how error.stack is read should be retested.

Several language features are on by default: Math.sumPrecise(), Intl.Locale.prototype.variants, Iterator.prototype.join(), Iterator.prototype.includes(), Iterator.zip() and Iterator.zipKeyed(). Three features remain behind flags: import defer (--js-defer-import-eval), Immutable ArrayBuffer (--js-immutable-arraybuffer) and RegExp buffer boundaries (--js-regexp-buffer-boundaries).

WebAssembly Flag Renames and asm.js Removal #

asm.js is no longer compiled to WebAssembly, and the --experimental-wasm-<name> flags are renamed --wasm-<name>. Launch scripts and CI jobs that pass the old flag names need the new ones. A full changelog of the V8 changes between 14.6 and 15.6 will be shared soon, so the complete list of V8 changes is not yet available.

Large resolveAny Replies Fix Tagged CVE-2026-58042 #

The release lists CVE-2026-58042 against commit 3e6cca0e6a, "handle large resolveAny address replies" (#64820). Code that calls dns.resolveAny() should be included in the upgrade review. The entry gives only the title, so the severity and affected range are not stated.

Who Is Affected by the Node.js 27 Alpha #

This is an alpha dated 2026-10-29, so it is a pre-release build. For production services on the 26 line, Node.js 26.13.0 is an LTS release that continues to receive updates through April 2029. This suggests that the 27 changes above reach a service only when that service moves to the 27 line.

Intel macOS support is downgraded to experimental (commit c362db6e24, #65427). Teams that build or run on Intel Macs should check their platform status before adopting this line.

Removals and Deprecations Listed as SEMVER-MAJOR #

These entries change behaviour that applications may depend on:

• The domain module is runtime-deprecated (#65074) and ported to AsyncLocalStorage (#61095).
• The --no-experimental-websocket CLI flag is removed (#65284).
• The legacy AsyncLocalStorage implementation is removed from async_hooks (#63641).
• _http_* modules are deprecated (#58535).
• The http keepAliveTimeout default increases to 65 seconds (#62782).
• req.headers gets a null prototype (#62900).
• net throws on multiple listen calls (#64871).
• DNS reverse lookups no longer consult the hosts file (#64268).
• dgram skips the custom lookup for literal IP addresses (#64131).
• The _tls_* functions move to End-of-Life (#60658).
• npm is upgraded to 12.1.0 (#66212).
• The --allow-env permission is added (#66132).
• fs glob is implemented natively (#65392).
• An experimental net/promises API is added (#63965).

Also in This Release #

The release notes list many more SEMVER-MINOR, SEMVER-PATCH, build, test and dependency commits. The full list is on the release page.