Node 26 closes the two-per-year cadence before Node 27 turns every release into an LTS

Undici 8 is the change most likely to touch live traffic, and it fires before the socket opens. Header validation got stricter, so a value carrying `\n` or `\r` is rejected instead of being silently sanitised ^[12][13]. The example in a dev.to upgrade guide is an `Authorization` header interpolated from a token that came back with a trailing newline ^[13]. Under Undici 7 that request left the process and failed at the server on the other side, which the guide calls far harder to debug ^[14]. The recommended fix is `token.trim()` where the value enters the system ^[15].

The stream removal is the one you cannot audit by reading your own code. Six internal modules, `_stream_readable` through `_stream_wrap`, deprecated since Node 12, are gone, and `require('_stream_readable')` throws `MODULE_NOT_FOUND` ^[9]. The guide's test is one line: `grep -rn "_stream_" node_modules --include="*.js" -l` ^[10]. If a package turns up, bump it to a version on `node:stream` or replace it, and `readable-stream` covers a mechanical migration when the code is yours ^[11].

`NODE_MODULE_VERSION` goes to 147, so bcrypt, sharp, better-sqlite3 and canvas each need a rebuild or a prebuild for the new ABI ^[16]. `npm rebuild` handles a laptop, and rebuilding the image on the new base handles CI and Docker ^[18]. The requirement that costs more is the build floor: GCC 13.2 minimum ^[19]. The base image goes into the migration alongside the runtime version.

The calendar is where I would spend the planning time. Node 27's alpha channel opens October 28, 2026, the same day 26 goes LTS, and 27 ships April 22, 2027 ^[5]. The alpha runs 176 days ^[1], the six-month window the guide points library maintainers at ^[23].

The same guide says one release a year means fewer migrations per decade ^[23]. Two releases a year is twenty per decade, of which the ten even ones were production-grade; one a year is ten, all LTS ^[2]. The number of production-eligible lines per decade is the same, and the ten odd releases go ^[4][2]. Whether a team migrates less often depends on how long each annual line is supported, and the guide lists end-of-life dates for 24 (April 30, 2028) and 26 (April 30, 2029) without one for 27 ^[6][2].

From 24, the guide calls the incompatible changes few and very localised, checklist work for most projects ^[20]. From 22 you absorb V8, permissions and the minimum glibc change that arrived in 24, on top of what is new in 26 ^[21]. Node 22 leaves maintenance in April 2027 ^[7], the same month Node 27 ships ^[3].