# What changed in @hono/node-server

> 16 changes in @hono/node-server 1 to 2 from its official release notes, upgrade guides and advisories: 2 breaking, 4 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/@hono/node-server/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @hono/node-server 2

### Breaking changes

- Static file serving now serves only GET and HEAD requests. (2.1.5) — [release notes](https://github.com/honojs/node-server/releases/tag/v2.1.5)
- Rejects request paths that still contain % after decoding, preventing crafted requests from bypassing middleware on static paths. Set allowPercentInPath: true to serve files whose names contain a literal %. (2.1.3) — [release notes](https://github.com/honojs/node-server/releases/tag/v2.1.3)

### Security

- Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake (2.0.10) — [security advisory](https://github.com/advisories/GHSA-9MQV-5HH9-4CGG)
- Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) (2.0.5) — [security advisory](https://github.com/advisories/GHSA-FRVP-7C67-39W9)

### New APIs and options

- Adds middleware for sending Early Hints (HTTP 103). (2.1.0) — [release notes](https://github.com/honojs/node-server/releases/tag/v2.1.0)

### Performance

- Request headers are now materialized lazily, improving performance. (2.1.1) — [release notes](https://github.com/honojs/node-server/releases/tag/v2.1.1)
- Request handling uses a fast path for the PATCH method. (2.0.11) — [release notes](https://github.com/honojs/node-server/releases/tag/v2.0.11)
- Request handling uses a fast path for QUERY methods. (2.0.11) — [release notes](https://github.com/honojs/node-server/releases/tag/v2.0.11)

### Fixes and other changes

- The request signal is aborted when an HTTP/2 client resets the stream. (2.1.5) — [release notes](https://github.com/honojs/node-server/releases/tag/v2.1.5)
- Hono v5 is now allowed as a peer dependency of @hono/node-server. (2.1.4) — [release notes](https://github.com/honojs/node-server/releases/tag/v2.1.4)
- Avoids mutating response headers when setting Content-Length. (2.1.2) — [release notes](https://github.com/honojs/node-server/releases/tag/v2.1.2)
- Fixes a type error in early hints. (2.1.2) — [release notes](https://github.com/honojs/node-server/releases/tag/v2.1.2)
- Avoids an uncaught error when force-closing a non-standard socket. (2.1.0) — [release notes](https://github.com/honojs/node-server/releases/tag/v2.1.0)
- Headers are now copied when the response initializer is a foreign Response. (2.0.12) — [release notes](https://github.com/honojs/node-server/releases/tag/v2.0.12)

## @hono/node-server 1

### Security

- @hono/node-server: Middleware bypass via repeated slashes in serveStatic (1.19.13) — [security advisory](https://github.com/advisories/GHSA-92PP-H63X-V22M)
- @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware (1.19.10) — [security advisory](https://github.com/advisories/GHSA-WC8C-QW6V-H7F6)