Stop Node from letting PHP file to be downloaded

I know PHP file doesn't get executed in node server, so it let the PHP file to be downloaded.

This is a huge security risk, isn't it? How to stop node from letting users download the php file?