Compat heads-up: Node.js 27.0.0-alpha.0 (async_hooks/domain, null-prototype req.headers, V8 15.6) #168

Daily third-party compatibility check for the JS SDK. One item since the last run (2026-10-29): Node.js 27 shipped its first prerelease, with a long list of semver-major changes. rrweb is still current (2.2.0 in both packages/rrweb and the fork pin bugsee/rrweb#987d0765), so no rrweb PRs are needed.

Heads-up: Node.js v27.0.0-alpha.0 (Oct 29, 18:36 UTC)

Prerelease only, no action required yet. Our root engines is ^22.23.4 || ^24.11.0 || >=26.0.0, so Node 27 is already inside the declared range once it ships, while CI only runs Node 22. Bundles V8 15.6, OpenSSL 4.1.0, npm 12.1.0, ABI modules 153.

Changes most likely to touch @bugsee/node, node-utils, the server framework adapters (express, fastify, hapi, koa, nestjs, hono, elysia) and opentelemetry (please verify against our code; I couldn't search the private repo's code):

• async_hooks: legacy AsyncLocalStorage implementation removed (#63641), and domain is now runtime-deprecated and ported onto AsyncLocalStorage (#65074, #61095). Any request/scope isolation or context propagation that relies on async_hooks timing or domain should be retested.
• http: req.headers now has a null prototype (#62900), so req.headers.hasOwnProperty(...) and similar calls throw; use Object.hasOwn. Also: responses that exceed the header limit are rejected (#65010), addTrailers after finish throws (#62832), instantiating http classes without new is runtime-deprecated (#64853), the default keepAliveTimeout goes up to 65 s (#62782), and the _http_* internals are deprecated (#58535). These matter for HTTP request capture and any monkey-patching of http.
• V8 15.6 behavior changes: error.stack is no longer looked up through the prototype chain (check stack extraction and any error subclasses/wrappers in the error capture path). await takes fewer microtasks, so ordering-sensitive tests may shift. v8.serialize(), structuredClone() and postMessage() use a new format that older Node releases can't read, which matters if anything we persist or send between workers is v8-serialized. Default heap limit and Buffer/ArrayBuffer heap accounting also change.
• net: calling listen() more than once throws (#64871), and family autoselection attempts now race (#66229).
• stream: the source is destroyed when a map iterator closes early (#64264).
• Crypto/TLS: OpenSSL 3+ is required, OpenSSL engine support ends, and Cipher/Hash encoding arguments are now validated. zlib classes are converted to modern syntax (DEP0184 EOL), and --no-experimental-websocket is removed. The src changes (node::ObjectWrap deprecated, CreateEnvironment() overloads merged) only matter for native addons and embedders.

Links: v27.0.0-alpha.0 release notes, Node.js dist index.

Suggested follow-up

1. Grep the Node packages for async_hooks, domain, req.headers.hasOwnProperty/in checks, error.stack access on prototypes, and http patching without new.
2. Add a non-blocking Node 27 nightly/alpha lane to CI (it currently only runs 22.x), alongside the existing Node 26 coverage.
3. Decide whether engines should keep >=26.0.0 open-ended or cap below 27 until 27.0.0 is validated.

Other movement since Oct 29 (no action)

Solid 1.9.18 and 2.0.0-rc.20, Angular 22.2.4 and 22.3.0-next.3, SvelteKit 3.1.1, Rspack 2.3.0, Electron 46.0.0-alpha.3 (covered by #116), Astro 7.4.4-beta.0, wrangler 4.156.0, Next 16.5 canary.32, React canary bumps, and the daily workerd/Bun canary builds. Node 26.13.0 LTS unchanged, Deno 2.9.8.

Filed automatically by the Bugsee JS SDK third-party compatibility tracker (weekday check). Versions and dates come from the npm registry, nodejs.org and GitHub releases on 2026-10-30.