On the custom server, DeprecationWarning: `url.parse()` warning!

[dincerpece]

Link to the code that reproduces this issue

https://github.com/dincerpece/custom-server-warning-feedback

To Reproduce

"custom-server-dev": "npx tsx nextjs-server/index.ts"

Since the release of Node.js 24.7.0 on August 27th, I’ve been getting a warning.
My previous nodejs version was 23.11.1 without any problems

Current vs. Expected behavior

I received a warning when working with a custom server after NodeJS 24.7.0. The project is running, but I receive a warning. I only receive this warning when working with a custom server. I receive this warning with the example on the NextJS website!

Provide environment information

Operating System:
  Platform: win32
  Arch: x64
  Version: Windows 11 Pro
  Available memory (MB): 32607
  Available CPU cores: 16
Binaries:
  Node: 24.7.0
  npm: 11.1.0
  Yarn: 1.22.22
  pnpm: N/A
Relevant Packages:
  next: 15.5.1-canary.16 // Latest available version is detected (15.5.1-canary.16).
  eslint-config-next: 15.5.1-canary.16
  react: 19.1.0
  react-dom: 19.1.0
  typescript: 5.9.2
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Runtime, Performance, Not sure

Which stage(s) are affected? (Select all that apply)

next dev (local), next start (local)

Additional context

When I received this warning in my own project, I tried a clean project and received the warning again, both in dev and production. Using the example on the Nextjs website, I received this warning on a custom server with NodeJS 24.7.0.

[JesseKoldewijn]

This is likely because the code in the example isn't compatible with the node version you're targeting which is called out in the doc as well.

[dincerpece]

This is likely because the code in the example isn't compatible with the node version you're targeting which is called out in the doc as well.

https://nextjs.org/docs/app/getting-started/installation Here, the minimum Node.js version is specified as Node.js 18.18. Could you share the link to that document? I might not have seen the content in the document where you mentioned this feature. As I said, this warning was not present in Node.js 23.11.1, which was released with the security update! I received this warning in Node.js 24.7.0, and it's clearly visible. Could you share the link to the content where you mentioned "this feature is also specified in the document."

[icyJoseph]

Mmm but you are using parse from url though... if you bring up the Node REPL

➜ node
Welcome to Node.js v24.7.0.
Type ".help" for more information.
> const { parse } = require("url")
undefined
> parse("https://Hello-world.com")
Url {
  protocol: 'https:',
  slashes: true,
  auth: null,
  host: 'hello-world.com',
  port: null,
  hostname: 'hello-world.com',
  hash: null,
  search: null,
  query: null,
  pathname: '/',
  path: '/',
  href: 'https://hello-world.com/'
}
> (node:40863) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
(Use `node --trace-deprecation ...` to show where the warning was created)

I guess you need to follow the recommendation given by Node.js ~

I used create-next-app with node 24.7.0 - and it didn't print this issue for dev, build, nor start.

As per docs, we likely have to add a note there about Node's 24 deprecation plans - or use some other approach

It is a bit tricky with this kind of deprecation - I'll see if we can do something

[icyJoseph]

Also the recommended replacement doesn't have expected shape by the handler 🤔 🤔

[JesseKoldewijn]

This is likely because the code in the example isn't compatible with the node version you're targeting which is called out in the doc as well.

https://nextjs.org/docs/app/getting-started/installation Here, the minimum Node.js version is specified as Node.js 18.18. Could you share the link to that document? I might not have seen the content in the document where you mentioned this feature. As I said, this warning was not present in Node.js 23.11.1, which was released with the security update! I received this warning in Node.js 24.7.0, and it's clearly visible. Could you share the link to the content where you mentioned "this feature is also specified in the document."

I was mostly referencing this part on the docs page you mentioned which to me sounds like a reasonable call-out

[icyJoseph]

Good news! Updates are being made to the documentation upstream:

• doc: provide alternative to url.parse() using WHATWG URL nodejs/node#59736

This is important because our custom server docs, would be able to point those using Node 24, to an official alternative, rather than settling for the deprecation or opening issues here, where we have little control over these, other than suggesting an alternative.

[wagerwizard]

Yeah, the problem is really that Next's RequestHandler type bakes in a parsedUrl: NextUrlWithParsedQuery which takes the shape of node's url.parse() return value. If you try to swap out for new URL(), the types no longer line up which causes TS compilation errors and it's not clear to me what runtime issues would arise downstream. NextJS implicitly forces use of url.parse() so there is no workaround until Next changes the types it expects.

I very much would like to be wrong about this, so if someone knows a way around this, please let me know!

---

In next/dist/server/next.d.ts:

export interface RequestHandler {
    (req: IncomingMessage, res: ServerResponse, parsedUrl?: NextUrlWithParsedQuery | undefined): Promise<void>;
}

In next/dist/server/request-meta.d.ts:

export interface NextUrlWithParsedQuery extends UrlWithParsedQuery {
    query: NextParsedUrlQuery;
}

UrlWithParsedQuery comes from node's types and is extended by Next.