NodeConf EU 2026 | Bologna, Italy

NodeConf EU 2026 · Running order
Two days, one track, 24 talks.
NodeConf EU 2026 was a single-track conference: everyone was in the same room for every talk. Two days of sessions at Hotel Savoia Regency in Bologna, with coffee breaks to recharge and a sit-down social dinner on the first evening. Every talk was recorded: open one to read the abstract, or jump straight to the video.
Tuesday · 29 September 2026
Registration & welcome coffee
Welcome to NodeConf EU 2026
The mission of the Web Interoperable Runtimes Technical Committee (WinterTC) at ECMA is the promotion of interoperability between all JavaScript runtimes, regardless of what role they play on the web. A key part of that effort is defining the minimum common API surface that developers in the ecosystem can expect runtimes to provide.
WinterTC started with an effort to define the common subset of Web platform APIs. Now the focus is switching to the common subset of Node.js compatibility APIs that all runtimes should support.
Improving the autocomplete in MongoDB's database CLI seemed like a great idea. But when the team tried to flip the feature flag, things quickly started to go sideways: a story of memory leaks, bugs that touch the very core of JavaScript as a language, and hard-learned lessons about testing and performance.
Most Node.js performance advice stops at "use async/await" and "run a profiler." This talk picks up where that ends. Drawing from years of shipping a high-throughput broadcast platform, we'll cover the patterns that actually move the needle: allocation-free hot paths, sync fast paths where async is 190× slower, cooperative scheduling, sqlite, and scaling with Workers.
You'll leave with a mental model of where Node.js spends its time and a handful of building blocks to drop into your own code.
Morning coffee break
A Node.js team you've probably never heard of is "next-10": we keep our ears to the ground, eyes on the sky, and fingers on the pulse. But what does that mean? Our mandate is to guide the project forward, ensuring we're delivering the features users want and also maintaining a healthy contributor environment.
To do that, we regularly check in with project maintainers, contributors, and end-users. This year, we uncovered some particularly interesting new trends and tidbits, as well as some long-standing issues that came to an (explosive) head.
We'll discuss those nuggets and landmines, and talk about what we're doing about them. Some highlights include:
At the Node.js Collaboration Summit 2024, a proposal for a new HTTP stack built around Web Standards such as Fetch, Request, Response, and Web Streams was presented.
But why does Node.js need a new HTTP server after more than 15 years? This talk explores the limitations of the current HTTP implementation, the challenges of evolving one of Node.js' oldest subsystems, and the motivations behind a new HTTP stack currently in development. While it's still too early to reveal all the details, we'll look at the problems we're trying to solve, the role of Web Standards in the design, and what this work could mean for the future of server-side JavaScript.
Observability tools in Node.js have changed quite a bit over time. As the language has evolved, the tools have had to keep up. Today, we have more complete and performant solutions than we've ever had before. In the future, we might be able to do even better.
This talk explores the history, the current state of the art, and the ideal future of observability primitives and instrumentation in Node.js.
JavaScript framework authors face a brutal tradeoff when it comes to observability: either ship "blind" code and rely on third parties to brittlely monkey-patch your API, or bloat your bundle with heavy observability dependencies. Both options hurt developer experience and performance.
Tracing channels changed this — a native, zero-dependency pattern that allows frameworks to emit events that are contextualized and execution-correlated end to end. In this session, I'll show how tracing channels enable open observability APIs that progressively enhance with newer Node.js versions and gracefully degrade with zero overhead.
We are leading an initiative to get libraries to adopt tracing channels, so we'll look at the top libraries and frameworks that have adopted it so far and what it means for APMs, users, and observability. The instrumentation tax no longer has to be paid.
Today's Node.js APM tooling is built on monkey-patching. Sentry, OpenTelemetry, dd-trace — they all reach into libraries from the outside, mutating require() cache entries to inject observability. This is fragile, ESM-hostile, and breaks every time a library refactors.
diagnostics_channel flips the model: libraries become active participants in their own observability, emitting structured events that any APM can subscribe to. No monkey-patching. No vendor-specific hooks. One shared bus.
The EU Cyber Resilience Act (CRA) is going to change how organisations build and ship products around the world — no longer will cybersecurity standard conformance be a marketing tool, it will be the baseline. This will impact all the roles in product development differently, and go far beyond your organisation's SPDLC checklists.
We'll go over the more important details of what's in the CRA, and then dive into how application developers might find themselves working toward initial conformity, and integrating cybersecurity requirements into their everyday work.
Afternoon coffee break
Supply-chain attacks are no longer rare or exotic; they are routine. Yet most Node.js applications are still deployed by resolving a dependency tree at install time, fetching it from a registry we don't run, and trusting that the bytes behind a version number are the ones someone actually reviewed. So how should we be shipping applications now? We need to know exactly what lands on our machines and what is actually running there, who vouches for it, and whether we can open it up and