@hono/node-server is a Node.js adapter that lets you run a Hono application on Node.js by using web standard Request/Response APIs. It provides a `serve` function to start the app, optional WebSocket support (via `upgradeWebSocket`), and Node.js-friendly helpers like ConnInfo and static file serving.
Project status
- Actively maintained: the upstream was pushed and updated on Nov 2, 2026.
- Updates have been frequent in recent months, with several in September and October and multiple on Nov 2.
AI summary generated
Recent updates
v1.19.18
v1.19.18 fixes a request-smuggling-style path normalization issue by rejecting raw backslashes in request paths with a 400 response. It also changes static-file path validation and updates the v1.x release and CI automation.
BreakingSecurityv2.1.6
v2.1.6 documents three WebSocket and request-path security fixes: rejecting raw backslashes in request paths, preserving the Host header when constructing WebSocket upgrade URLs, and handling socket errors or closes during asynchronous upgrades. The code diff contains substantially broader changes, including static-file behavior changes, new APIs, and request/response handling modifications that are not described in the release notes.
Securityv2.1.5
v2.1.5 includes fixes for request abort handling in the HTTP/2 listener, and tightens serveStatic behavior to only handle GET and HEAD. The code changes also adjust serve-static middleware to pass all other HTTP methods to downstream middleware without touching files.
Breakingv2.1.4
Release v2.1.4 makes a small packaging change to broaden compatibility with Hono. Specifically, it updates the package.json peer dependency range to allow Hono v5 prereleases in addition to the existing v4 range.
Featuresv2.1.3
v2.1.3 patches a security issue in @hono/node-server/serveStatic where percent-encoded request paths could be effectively decoded twice, bypassing middleware mounted on a static prefix. The fix adds an opt-in option, allowPercentInPath, to preserve the prior behavior for static filenames that include a literal percent character. The release also updates README documentation and adds comprehensive test coverage for the percent-path cases.
BreakingSecurityFeaturesv2.1.2
v2.1.2 mainly adds CI improvements (format/lint autofix workflow, typecheck step) and updates/extends benchmark coverage. It also contains a significant change to the Node listener's Content-Length handling, plus a test fix around asynchronous body read errors. Release notes mention these items, but the listener change appears more invasive in the actual implementation than what is described.
v2.1.1
v2.1.1 focuses on improving request header handling performance, specifically by lazily materializing request headers. The code adds a dedicated headers implementation that optimizes common header lookups and defers full header parsing until necessary.
v2.1.0
v2.1.0 release notes document two changes, adding an Early Hints (HTTP 103) middleware and fixing a listener uncaught error for non-standard sockets. The actual code diff shows substantially more than those two items, including new WebSocket upgrade support, major request/response behavior changes (including stricter Request construction rules), and multiple HTTP static serving and header-handling modifications that are not mentioned in the release notes.
Featuresv1.19.17
This release does not provide any publisher release notes. The code changes primarily harden the serveStatic path validation logic against path traversal style inputs, and adjust CI/release automation configuration.
BreakingSecurityv2.0.12
v2.0.12 updates the test suite to stop using supertest and switch to @BlankParticle, and it includes a fix to ensure Response headers are copied when a Response is constructed from a foreign (fetch) Response. The actual code diff also includes refactors in the Request/Response internals and a TypeScript configuration change that are not mentioned in the release notes.
v2.0.11
v2.0.11 includes request method fast paths intended to improve performance for QUERY and PATCH handling, plus test-only changes to simplify request construction for traversal tests. The only production code changes shown are in `src/request.ts` and they mainly adjust method normalization logic.
v2.0.10
v2.0.10 patches a security issue in the WebSocket upgrade flow for @hono/node-server. It specifically addresses a memory-leak scenario when an unauthenticated client aborts the WebSocket handshake before a connection is established.
Securityv2.0.9
This release v2.0.9 focuses on correctness fixes in three areas: WebSocket ErrorEvent handling, serve-static HTTP Range parsing, and recovering request bodies when clients disconnect. The code changes are substantially more detailed than the brief release notes, especially around request-body recovery logic and error preservation.
v2.0.8
Release v2.0.8 makes a small change to the release workflow, adding the pnpm publish flag `--no-git-checks` for `pnpm stage publish`. It also bumps the package version in `package.json` from 2.0.7 to 2.0.8.
Featuresv2.0.7
v2.0.7 migrates the repo tooling from Bun to pnpm, updates CI/workflows accordingly, and bumps the test dependency supertest. It also changes serve-static behavior to serve precompressed assets for application/octet-stream responses when precompressed files are available.
v2.0.6
v2.0.6 updates CI publishing to npm using OIDC trusted publishing and npm staged publishing. It also fixes Response cloning when using live headers so that status and statusText are preserved. Additional unit tests were added to cover status and statusText preservation behavior.
v2.0.5
v2.0.5 is a targeted security release for Serve Static Middleware on Windows. It fixes a bypass condition involving prefix-mounted middleware, and adds additional path validation and test coverage to prevent maliciously crafted URLs from resolving static files.
Securityv2.0.4
v2.0.4 introduces a set of locally defined WebSocket interface stubs to avoid importing `ws` types into the package's public TypeScript surface. The runtime logic for websocket upgrade/handshakes remains effectively the same, but several exported TypeScript types used by `upgradeWebSocket` and the `websocket.server` option were retargeted to these new stubs.
Featuresv2.0.3
v2.0.3 primarily fixes a header-cloning regression in the Response implementation, ensuring that headers mutated after a raw Response is constructed are preserved when the response is later cloned. The release notes also mention CI action version updates and a documentation comment alignment for ServeStaticOptions.
v2.0.2
v2.0.2 contains fixes to the serve-static adapter, specifically around HTTP header values and stream fallback behavior. The code changes also refactor the stream fallback logic into a new utility module and adjust headers emitted for static responses.
Breaking