npm / @hono/node-server

@hono/node-server

What changed in @hono/node-server 1 to 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.

2 breaking4 security1 new APIs and options3 performance6 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@hono/node-server 214 changes

Static file serving now serves only GET and HEAD requests.
2.1.5release notes
Rejects request paths that still contain % after decoding, preventing crafted requests from bypassing middleware on static paths. Set allowPercentInPath: true to serve files whose names contain a literal %.
2.1.3release notes

Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake
2.0.10security advisory
Node.js Adapter for Hono: Path traversal in serve-static on Windows via encoded backslash (%5C)
2.0.5security advisory

Request headers are now materialized lazily, improving performance.
2.1.1release notes
Request handling uses a fast path for the PATCH method.
2.0.11release notes
Request handling uses a fast path for QUERY methods.
2.0.11release notes

The request signal is aborted when an HTTP/2 client resets the stream.
2.1.5release notes
Hono v5 is now allowed as a peer dependency of @hono/node-server.
2.1.4release notes
Avoids mutating response headers when setting Content-Length.
2.1.2release notes
Fixes a type error in early hints.
2.1.2release notes
Avoids an uncaught error when force-closing a non-standard socket.
2.1.0release notes
Headers are now copied when the response initializer is a foreign Response.
2.0.12release notes

@hono/node-server: Middleware bypass via repeated slashes in serveStatic
1.19.13security advisory
@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
1.19.10security advisory