# What changed in @astrojs/node

> 41 changes in @astrojs/node 9 to 11 from its official release notes, upgrade guides and advisories: 9 breaking, 11 security. Each one cited. Sources checked 2026-10-24. HTML: https://unstale.sh/npm/@astrojs/node/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @astrojs/node 11

### Breaking changes

- The adapter waits for the configured log destination through Astro’s app.getLogger() API. Requires Astro 7.2.1 or later. (11.1.3) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4011.1.3)

### Security

- The Node adapter validates the Host header against security.allowedDomains. (11.1.7) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4011.1.7)
- Astro: Malformed port in the Host header can crash the Node adapter (11.1.3) — [security advisory](https://github.com/advisories/GHSA-QH8J-HQJV-7M4X)
- Astro: Unauthenticated path override in the @astrojs/vercel ISR function (11.0.3) — [security advisory](https://github.com/advisories/GHSA-X27W-589X-FRM2)
- @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect (11.0.2) — [security advisory](https://github.com/advisories/GHSA-R557-WFFQ-WVRC), [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4011.0.2)

### Behavior and default changes

- When session: false is set in astro.config, the adapter no longer auto-wires the filesystem session driver, allowing the session runtime to be tree-shaken from the server bundle. (11.1.0) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4011.1.0)

### Fixes and other changes

- Fixes the standalone server not logging “Server listening on …” when HOST is an IP address on Node.js 26.12 and later. (11.1.9) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4011.1.9)
- Fixes standalone mode silently exiting with code 0 when EADDRINUSE occurs. (11.1.8) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4011.1.8)
- Prevents aborted request bodies from causing duplicate unhandled rejection logs in standalone mode. (11.1.6) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4011.1.6)
- Preserves query strings containing a second `?` character during trailing-slash redirects. (11.1.6) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4011.1.6)
- Unknown parameters that match a prerendered dynamic endpoint now return a 404 instead of a 500. (11.1.2) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4011.1.2)
- Fixes an EventEmitter memory leak when serving static pages over keep-alive connections with staticHeaders enabled and CSP active. (11.1.1) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4011.1.1)
- Fixes routing when a prerendered dynamic route sorts before an on-demand fallback. (11.1.0) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4011.1.0)
- Corrects the dependencies listed in the package’s peerDependencies field. (11.0.1) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4011.0.1)
- Astro files with non-ASCII characters in their names are now correctly served after the build. (11.0.0) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4011.0.0)

## @astrojs/node 10

### Breaking changes

- The adapter now depends on Astro 6.3.0, affecting which Astro versions it can be used with. (10.1.0) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4010.1.0)
- The Astro peer dependency is updated to 6.0.0, affecting which Astro versions are compatible with @astrojs/node. (10.0.2) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4010.0.2)
- Removes this adapter option for fetching a prerendered error page from another host; implement a secure alternative with middleware. (10.0.0) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4010.0.0)
- Stabilizes the adapter feature and replaces the experimentalStaticHeaders flag with staticHeaders. (10.0.0) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4010.0.0)
- Trusts X-Forwarded-Proto only when allowedDomains is configured. (10.0.0) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4010.0.0)

### Security

- Conditional request failures now return the correct status code without far-future cache directives. (10.0.5) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4010.0.5), [security advisory](https://github.com/advisories/GHSA-C57F-MM3J-27Q9)
- Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` (10.0.2) — [security advisory](https://github.com/advisories/GHSA-MR6Q-RP88-FX84)
- Sets the maximum allowed request body size for the Node.js standalone server in bytes; the default is 1 GB, and 0 disables the limit. (10.0.0) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4010.0.0), [security advisory](https://github.com/advisories/GHSA-3RMJ-9M5H-8FPV)
- Passes the actual server listening port to createRequest so the constructed URL origin includes the correct port. (10.0.0) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4010.0.0)
- Normalizes paths before evaluating dotfile access rules and ensures resolved static file paths stay within the client directory. (10.0.0) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4010.0.0)

### Fixes and other changes

- The logger destination is now used for the “Server listening on...” startup message. (10.1.4) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4010.1.4)
- In standalone mode, the Node adapter now resolves clean URLs to prerendered .html files when using build.format: 'file' or 'preserve'. (10.1.3) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4010.1.3)
- Read streams are now destroyed on client disconnect or read errors, fixing file descriptor leaks. (10.0.4) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4010.0.4)
- When the expected server directory segment is not found in the file path, resolveClientDir() now throws a descriptive error instead of hanging indefinitely. (10.0.4) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4010.0.4)
- The middleware handler cleans up socket listeners before calling next() for requests passed on to Express or Fastify, preventing an EventEmitter memory leak warning. (10.0.3) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4010.0.3)
- Fixes an issue where the adapter caused a series of warnings during the build. (10.0.1) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4010.0.1)
- Fixes the Node.js adapter failing to serve a 404 page matching a pre-rendered dynamic route pattern. (10.0.0) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4010.0.0)
- Fixes static headers not being correctly applied when the website uses base. (10.0.0) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%4010.0.0)

## @astrojs/node 9

### Breaking changes

- @astrojs/node now requires Astro 5.17.3 or later. (9.5.4) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%409.5.4)
- A default body size limit is added for server actions to prevent oversized requests from exhausting memory. (9.5.4) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%409.5.4), [security advisory](https://github.com/advisories/GHSA-JM64-8M5Q-4QH8)
- The adapter was updated for Astro 5 hybrid rendering; projects using this release need to use Astro 5. (9.0.0) — [release notes](https://github.com/withastro/astro/blob/HEAD/packages/integrations/node/CHANGELOG.md)

### Security

- Astro has Full-Read SSRF in error rendering via Host: header injection (9.5.4) — [security advisory](https://github.com/advisories/GHSA-QQ67-MVV5-FW3G)
- Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize (9.5.4) — [security advisory](https://github.com/advisories/GHSA-CJ9F-H6R6-4CX2)

### Behavior and default changes

- Error pages are now loaded from disk first, falling back to the configured host. (9.5.3) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%409.5.3)

### Fixes and other changes

- Fixes prerendered pages that were not correctly rendered when using the Node.js adapter in middleware mode. (9.5.2) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%409.5.2)
- Fixes an image 500 error when moving the dist directory in standalone Node. (9.5.2) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/node%409.5.2)