What changed
H3 v2.0.1 was declared stable on October 3, 2026; v2.0.2 followed on October 7. The minimal HTTP framework used in the UnJS/Nitro ecosystem has been rewritten around the standard Web Request, Response, URL and Headers APIs, with srvx runtime adapters for Node.js and native interfaces on other platforms. It replaces createApp/createRouter with new H3(), adopts rou3 v1 route matching, changes how middleware scopes match paths, and encourages returning strings, objects, streams or Response objects instead of calling send utilities. Node.js >=20.19 is required. Its migration guide documents changes in proxy-header trust, request-body parsing, cookie handling and renamed utilities.
Why it matters
This is a foundational server-framework change rather than a cosmetic version increment. Developers writing custom H3, Nitro or related framework handlers may rely on v1's implicit response writes, route matching or forwarded headers. Migrating blindly can break routes, middleware coverage or security assumptions, while the standards-first API can make cross-runtime deployment and testing simpler. The latest patch also includes fixes to stream error handling and response middleware.
Standard web requests replace Node-specific event conventions
Handlers now receive event.req as a standard Request and event.url as URL, and can return a string, object, stream, Blob or Response. Headers use the native Headers interface. The same app can run on Node, Bun, Deno, Workers and service-worker-style environments through the appropriate runtime adapter. Node-specific req/res remain available only when running under Node.
Routes and middleware scopes need explicit testing
H3 v2 uses the rou3 router. Middleware app.use('/path', handler) now matches that path only, not all descendants; use '/path/**' for subpaths. Later rou3 v1 routing changes alter '*' wildcard breadth, segment capture behaviour and route-rule keys. Test authentication guards, redirects and catch-all patterns with both expected and malformed paths.
Response handling and forwarded-header trust change
Migrate send(event,value) to explicit return values and sendError to thrown errors. Body reading uses standard Request methods such as event.req.json(). The migration guide warns that getRequestProtocol/getRequestURL no longer trust x-forwarded-proto by default; explicit opt-in is needed only behind trusted proxies. Older utilities remain as compatibility exports in many cases, but not all.
Stable release with a still-evolving migration guide
The maintainers marked v2.0.1 stable on October 3 and published v2.0.2 on October 7. The migration page still contains an older beta-stage notice, so prefer the stable release and current changelog for status. The v2.0.2 patch fixes Node stream-error handling, redirect reason phrases and middleware onError response propagation.