npm / @astrojs/node

@astrojs/node

What changed in @astrojs/node 9 to 11, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-24.

9 breaking11 security2 behavior and defaults19 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@astrojs/node 1115 changes

The adapter waits for the configured log destination through Astro’s app.getLogger() API. Requires Astro 7.2.1 or later.
11.1.3release notes

The Node adapter validates the Host header against security.allowedDomains.
11.1.7release notes
Astro: Malformed port in the Host header can crash the Node adapter
11.1.3security advisory
Astro: Unauthenticated path override in the @astrojs/vercel ISR function
11.0.3security advisory
@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect
11.0.2security advisory release notes

When session: false is set in astro.config, the adapter no longer auto-wires the filesystem session driver, allowing the session runtime to be tree-shaken from the server bundle.
11.1.0release notes

Fixes the standalone server not logging “Server listening on …” when HOST is an IP address on Node.js 26.12 and later.
11.1.9release notes
Fixes standalone mode silently exiting with code 0 when EADDRINUSE occurs.
11.1.8release notes
Prevents aborted request bodies from causing duplicate unhandled rejection logs in standalone mode.
11.1.6release notes
Preserves query strings containing a second ? character during trailing-slash redirects.
11.1.6release notes
Unknown parameters that match a prerendered dynamic endpoint now return a 404 instead of a 500.
11.1.2release notes
Fixes an EventEmitter memory leak when serving static pages over keep-alive connections with staticHeaders enabled and CSP active.
11.1.1release notes
Fixes routing when a prerendered dynamic route sorts before an on-demand fallback.
11.1.0release notes
Corrects the dependencies listed in the package’s peerDependencies field.
11.0.1release notes
Astro files with non-ASCII characters in their names are now correctly served after the build.
11.0.0release notes

The adapter now depends on Astro 6.3.0, affecting which Astro versions it can be used with.
10.1.0release notes
The Astro peer dependency is updated to 6.0.0, affecting which Astro versions are compatible with @astrojs/node.
10.0.2release notes
Removes this adapter option for fetching a prerendered error page from another host; implement a secure alternative with middleware.
10.0.0release notes
Stabilizes the adapter feature and replaces the experimentalStaticHeaders flag with staticHeaders.
10.0.0release notes
Trusts X-Forwarded-Proto only when allowedDomains is configured.
10.0.0release notes

Conditional request failures now return the correct status code without far-future cache directives.
10.0.5release notes security advisory
Astro: Unauthenticated Path Override via x-astro-path / x_astro_path
10.0.2security advisory
Sets the maximum allowed request body size for the Node.js standalone server in bytes; the default is 1 GB, and 0 disables the limit.
10.0.0release notes security advisory
Passes the actual server listening port to createRequest so the constructed URL origin includes the correct port.
10.0.0release notes
Normalizes paths before evaluating dotfile access rules and ensures resolved static file paths stay within the client directory.
10.0.0release notes

The logger destination is now used for the “Server listening on...” startup message.
10.1.4release notes
In standalone mode, the Node adapter now resolves clean URLs to prerendered .html files when using build.format: 'file' or 'preserve'.
10.1.3release notes
Read streams are now destroyed on client disconnect or read errors, fixing file descriptor leaks.
10.0.4release notes
When the expected server directory segment is not found in the file path, resolveClientDir() now throws a descriptive error instead of hanging indefinitely.
10.0.4release notes
The middleware handler cleans up socket listeners before calling next() for requests passed on to Express or Fastify, preventing an EventEmitter memory leak warning.
10.0.3release notes
Fixes an issue where the adapter caused a series of warnings during the build.
10.0.1release notes
Fixes the Node.js adapter failing to serve a 404 page matching a pre-rendered dynamic route pattern.
10.0.0release notes
Fixes static headers not being correctly applied when the website uses base.
10.0.0release notes

@astrojs/node now requires Astro 5.17.3 or later.
9.5.4release notes
A default body size limit is added for server actions to prevent oversized requests from exhausting memory.
9.5.4release notes security advisory
The adapter was updated for Astro 5 hybrid rendering; projects using this release need to use Astro 5.
9.0.0release notes

Astro has Full-Read SSRF in error rendering via Host: header injection
9.5.4security advisory
Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize
9.5.4security advisory

Error pages are now loaded from disk first, falling back to the configured host.
9.5.3release notes

Fixes prerendered pages that were not correctly rendered when using the Node.js adapter in middleware mode.
9.5.2release notes
Fixes an image 500 error when moving the dist directory in standalone Node.
9.5.2release notes