[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
fastify (source)	^3.29.5 → ^5.0.0

---

Fastify's Content-Type header tab character allows body validation bypass

CVE-2026-25223 / GHSA-jx2c-rxcm-jvmq

More information

Details

Impact

A validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type.

For example, a request with Content-Type: application/json\ta will bypass JSON schema validation but still be parsed as JSON.

This vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints. The concrete impact depends on the handler implementation and the level of trust placed in the validated request body, but at the library level, this allows complete bypass of body validation for any handler using Content-Type-discriminated schemas.

This issue is a regression or missed edge case from the fix for a previously reported vulnerability.

Patches

This vulnerability has been patched in Fastify v5.7.2. All users should upgrade to this version or later immediately.

Workarounds

If upgrading is not immediately possible, user can implement a custom onRequest hook to reject requests containing tab characters in the Content-Type header:

fastify.addHook('onRequest', async (request, reply) => {
  const contentType = request.headers['content-type']
  if (contentType && contentType.includes('\t')) {
    reply.code(400).send({ error: 'Invalid Content-Type header' })
  }
})

Resources

• https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272
• https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125
• Fastify Validation and Serialization Documentation
• https://hackerone.com/reports/3464114

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq
• https://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821
• https://hackerone.com/reports/3464114
• https://fastify.dev/docs/latest/Reference/Validation-and-Serialization
• https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125
• https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272
• https://nvd.nist.gov/vuln/detail/CVE-2026-25223
• https://github.com/advisories/GHSA-jx2c-rxcm-jvmq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections

CVE-2026-3635 / GHSA-444r-cwp2-x5xf

More information

Details

Summary

When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.

Affected Versions

fastify <= 5.8.2

Impact

Applications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.

When trustProxy: true (trust everything), both host and protocol trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf
• https://nvd.nist.gov/vuln/detail/CVE-2026-3635
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.8.3
• https://www.cve.org/CVERecord?id=CVE-2026-3635
• https://github.com/advisories/GHSA-444r-cwp2-x5xf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to schema validation bypass via root primitive coercion mismatch

CVE-2026-18504 / GHSA-w2qp-rph6-63g4

More information

Details

Impact

fastify before 5.12.1, when a route uses a root-level primitive body schema (for example an integer with a minimum and maximum) and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body "10" is coerced to the number 10 and passes an integer 1 to 10 schema, but request.body stays the string "10". An application that trusts the validated type is handed a value that did not satisfy the schema, which can bypass limits the application enforces on that typed value. Object and array body schemas are not affected, they coerce their members in place.

Patches

Upgrade to fastify 5.12.1.

Workarounds

Until you can upgrade, avoid relying on the validated type of a root primitive body. Wrap the value in an object schema (object properties are coerced in place), for example accept { "value": 10 } and read request.body.value, or re-check the type in the handler.

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-w2qp-rph6-63g4
• https://nvd.nist.gov/vuln/detail/CVE-2026-18504
• https://github.com/fastify/fastify/commit/1ef8a60c87e94f42f666aa15ad68957772a83655
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.1
• https://github.com/advisories/GHSA-w2qp-rph6-63g4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to request validation bypass via skipped boolean false schemas

CVE-2026-84469 / GHSA-hwr6-493r-vm6h

More information

Details

Impact

Fastify decided whether to validate a request part by checking its schema for JavaScript truthiness. JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance, but because false is falsy, a route that set body, querystring, params, or headers to false had that part left uncompiled: no validator was attached and the request reached the handler. An application that used false as a deny-all schema to make a route unreachable was therefore fully bypassed, and an unauthenticated remote client could reach the handler with any input. The same applied to the documented query alias for querystring. This is a complete bypass rather than a weak-schema issue, since false is the strongest JSON Schema assertion and must always fail.

Patches

Request-part schemas are now selected by an explicit presence check rather than truthiness, so a boolean false (or true) schema is compiled and enforced, including through the query alias. Patched in fastify 5.12.2. The fix is also included in the 6.0.0 release.

Workarounds

If upgrading is not immediately possible, express a deny-all request schema with an always-failing object schema instead of the boolean false (for example { "not": {} }), or reject the request in an onRequest hook.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6h
• https://nvd.nist.gov/vuln/detail/CVE-2026-84469
• https://github.com/fastify/fastify/commit/7de6e81697778f9f41bd327a3b1c5c9a0d9637b4
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.2
• https://github.com/advisories/GHSA-hwr6-493r-vm6h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to request body replacement via an async validation result collision

CVE-2026-84504 / GHSA-667r-xxjv-c9mm

More information

Details

Impact

Fastify runs a route's validator and, for a result shaped like { value, error }, unwraps it: an error becomes a validation failure and value replaces the request part. This convention is intended for synchronous custom compilers (for example Joi). A JSON Schema $async validator, however, resolves with the validated data itself, so Fastify applied the same unwrapping to it. If a request part validated by an $async schema contains a value property, Fastify replaced the whole request part with that nested value before the handler ran, so a value or error property in the payload was attacker-controlled. An application that dispatches operations from the validated request body could then act on data that never satisfied the route schema, leading to unauthorized state changes or disclosure. Reaching the vulnerable path requires the route to use an $async request schema.

Patches

Fastify no longer treats an asynchronous validation result as a { value, error } wrapper: an async validator's resolved value is used only to determine pass or fail, and it can no longer replace the request part or inject an error. The synchronous custom-compiler contract is unchanged. Patched in fastify 5.12.2 and 6.0.0.

Workarounds

If upgrading is not immediately possible, avoid $async request schemas, or perform the security-sensitive check in an onRequest or preHandler hook rather than relying on the schema-validated request part. Custom async validator compilers should signal failure by throwing (rejecting) rather than returning an { error } object.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-667r-xxjv-c9mm
• https://nvd.nist.gov/vuln/detail/CVE-2026-84504
• https://github.com/fastify/fastify/commit/f02d8d4ab1ab208f10819c4dc213595b06497833
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.2
• https://github.com/advisories/GHSA-667r-xxjv-c9mm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

fastify/fastify (fastify)

v5.12.2

Compare Source

⚠️ Security release

• Fix for GHSA-9q9j-q6p8-xq58
• Fix for GHSA-hwr6-493r-vm6h
• Fix for GHSA-p68q-wchp-6fh7
• Fix for GHSA-667r-xxjv-c9mm

What's Changed

• [Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @​github-actions[bot] in #​6973
• [Backport 5.x] chore: npm ignore remaining agent files by @​github-actions[bot] in #​7003

Full Changelog: fastify/fastify@v5.12.1...v5.12.2

v5.12.1

Compare Source

⚠️ Security release

• Fix for GHSA-w2qp-rph6-63g4
• Fix for GHSA-3m5p-2c4r-xxw2

What's Changed

• [Backport 5.x] test: fix reply.mediaType by @​github-actions[bot] in #​6950
• [Backport 5.x] ci: allow backport in pr title by @​github-actions[bot] in #​6952
• [Backport 5.x] fix: run preClose hook exactly once per declaring instance by @​github-actions[bot] in #​6954
• [Backport 5.x] fix: report canonical route url for hidden prefix slash route by @​github-actions[bot] in #​6961

Full Changelog: fastify/fastify@v5.12.0...v5.12.1

v5.12.0

Compare Source

What's Changed

• chore(sponsor): add testmu ai by @​Eomm in #​6922
• docs: add per-route logging for Google Cloud Functions by @​slegarraga in #​6907
• test: remove @​sinonjs/fake-timers by @​climba03003 in #​6934
• [Backport 5.x] fix: remove raw response headers by @​github-actions[bot] in #​6939
• [Backport 5.x] test: use process-warning spyWarning for testing by @​github-actions[bot] in #​6945
• [Backport 5.x] feat: add Reply.prototype.mediaType by @​github-actions[bot] in #​6946
• [Backport 5.x] fix(content-type): return undefined for invalid media types by @​github-actions[bot] in #​6947

Full Changelog: fastify/fastify@v5.11.3...v5.12.0

v5.11.3

Compare Source

What's Changed

• fix: clear trailer state when removing all trailers by @​Ram-blip in #​6845
• docs: document percent-decoded route params as untrusted input by @​mcollina in #​6903
• docs(errors): document what the default error handler sends by @​basteez in #​6894
• docs(readme): fix grammar and cjs capitalization by @​minirang in #​6899
• fix: pass null instead of undefined to requestCompleted on success by @​lazerg in #​6837
• docs(encapsulation): clarify nested plugin scopes by @​jean-michelet in #​6893
• chore: Bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​6916
• chore: Bump fastify/workflows/.github/workflows/nested-quality.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​6917
• fix: recognize constructor-assigned built-in properties as decorator … by @​aquie00t in #​6892
• fix: reset lastIndex before testing global/sticky content-type RegExp parsers by @​zelinewang in #​6846

New Contributors

• @​minirang made their first contribution in #​6899
• @​lazerg made their first contribution in #​6837
• @​zelinewang made their first contribution in #​6846

Full Changelog: fastify/fastify@v5.11.2...v5.11.3

v5.11.2

Compare Source

What's Changed

• fix fastify version in fastify.js

Full Changelog: fastify/fastify@v5.11.1...v5.11.2

v5.11.1

Compare Source

What's Changed

• fix: add http method override warning by @​jean-michelet in #​6879
• fix(types): allow explicit http2: false in server options by @​Tony133 in #​6888
• docs: clarify what attachValidation exposes on request.validationError by @​basteez in #​6891
• fix: do not force close in-flight connections when forceCloseConnections is 'idle' by @​aquie00t in #​6889

New Contributors

• @​basteez made their first contribution in #​6891

Full Changelog: fastify/fastify@v5.11.0...v5.11.1

v5.11.0

Compare Source

What's Changed

• chore: Bump markdownlint-cli2 from 0.22.1 to 0.23.0 by @​dependabot[bot] in #​6839
• fix: normalize method in findRoute by @​Ram-blip in #​6838
• docs: fix incorrect description for validateInput in Request.md by @​thePranav-kpk in #​6823
• feat: rfc10008 http query method by @​climba03003 in #​6832
• perf: reuse cached content types for response serialization by @​gurgunday in #​6854
• chore(sponsor): add n-ix by @​Eomm in #​6852
• ci: pin actions to commit-hash by @​Fdawgs in #​6853
• ci(dependabot): temporarily ignore typescript updates by @​Tony133 in #​6869
• style(types): enforce max line length by @​jean-michelet in #​6864
• docs(ecosystem): update fastify-prisma repo URL by @​zrosenbauer in #​6724
• docs(getting-started): align import with exported routes by @​Solaris-star in #​6859
• docs(server): fix contradictory requestIdHeader default by @​sobol-sudo in #​6872
• fix(validation): correctly update falsy values from validator by @​jackjin1997 in #​6483
• docs: specific warning suppression by @​jean-michelet in #​6871
• ci(links-check): pin linkinator server root to the workspace by @​aquie00t in #​6877
• docs: update TypeScript docs to reference Fastify 5.x by @​Sasireddy001 in #​6880
• docs: use async trailer handlers in Reply examples by @​Ram-blip in #​6856
• docs: fix logController migration example and links by @​aquie00t in #​6876
• fix: uncatchable throws in writeHead when using async hook by @​climba03003 in #​6881
• fix: honor quoted-string in Content-Type parameter values by @​aquie00t in #​6865
• chore(.npmrc): add min-release-age by @​Fdawgs in #​6873
• chore: Bump actions/setup-node from 6.4.0 to 7.0.0 by @​dependabot[bot] in #​6866
• chore: Bump actions/labeler from 6.2.0 to 7.0.0 by @​dependabot[bot] in #​6867

New Contributors

• @​Ram-blip made their first contribution in #​6838
• @​Solaris-star made their first contribution in #​6859
• @​sobol-sudo made their first contribution in #​6872
• @​jackjin1997 made their first contribution in #​6483
• @​Sasireddy001 made their first contribution in #​6880

Full Changelog: fastify/fastify@v5.10.0...v5.11.0

v5.10.0

Compare Source

What's Changed

• docs(type-providers): clarify as const usage by @​smith558 in #​6772
• docs: fix broken and redirected links by @​Eomm in #​6817
• docs: remove marko from @​fastify/view engines (support dropped) by @​EduardF1 in #​6821
• fix: clear socket._meta on reply.hijack() when onTimeout is registered by @​nerkoux in #​6810
• docs: fix duplicate routeOptions entries in Request.md example by @​thePranav-kpk in #​6824
• chore: Bump @​types/node from 25.9.4 to 26.0.1 in the dev-dependencies-typescript group by @​dependabot[bot] in #​6829
• docs(ecosystem): add @​stitchapi/fastify to Community plugins by @​rejifald in #​6820
• feat: introduce log controller layer by @​Eomm in #​6580
• fix: use ContentType to detect json and charset in reply.send by @​climba03003 in #​6830
• docs: fix incorrect defaults and code examples in Server.md by @​Adit-Jain-srm in #​6805
• docs: fix incorrect hook count in Hooks.md by @​thePranav-kpk in #​6825
• chore: Bump fast-json-stringify from 6.4.0 to 7.0.0 in the dependencies group across 1 directory by @​dependabot[bot] in #​6800
• perf: reduce per-request overhead in the request lifecycle by @​mcollina in #​6831
• fix: derive request.port from request.host by @​mcollina in #​6680
• docs: update Logging.md with per-route log level info by @​asppsa in #​6627
• docs(type-providers): update import for article consistency by @​smith558 in #​6771

New Contributors

• @​EduardF1 made their first contribution in #​6821
• @​thePranav-kpk made their first contribution in #​6824
• @​rejifald made their first contribution in #​6820
• @​Adit-Jain-srm made their first contribution in #​6805
• @​asppsa made their first contribution in #​6627

Full Changelog: fastify/fastify@v5.9.0...v5.10.0

v5.9.0

Compare Source

What's Changed

• feat: add request.mediaType by @​climba03003 in #​6653
• docs: remove deprecated leveldb plugin and update ecosystem by @​Tony133 in #​6661
• chore(sponsor): add bestforandroid by @​Eomm in #​6659
• ci: drop Node.js 20 from yarn matrix in package-manager-ci.yml by @​Tony133 in #​6662
• fix: prevent duplicate res.end in sendTrailer with sync callbacks by @​climba03003 in #​6676
• fix: avoid duplicate closeIdleConnections call on native servers by @​trivikr in #​6669
• fix: error.code not present on some routing errors by @​mcollina in #​6678
• fix: correct isCustomSerializerCompiler flag check by @​eddieran in #​6657
• fix: validate invalid route logLevel at registration by @​maxpetrusenko in #​6523
• docs: update contribution rules by @​Tony133 in #​6670
• fix: use ContentType parser for response schema lookup by @​UlisesGascon in #​6685
• ci(ci): use shared quality workflow by @​Fdawgs in #​6688
• fix(types): allow request.getValidationFunction() to return undefined by @​trivikr in #​6665
• fix: do not trust forwarded host/proto when socket is missing by @​mcollina in #​6684
• perf: defer ContentType parsing in getSchemaSerializer until needed by @​aquie00t in #​6692
• perf: cache parsed ContentType objects in ContentTypeParser by @​aquie00t in #​6694
• perf: add typeof guard before toString.call in send and onSendEnd by @​aquie00t in #​6693
• chore: Bump pnpm/action-setup from 5.0.0 to 6.0.4 by @​dependabot[bot] in #​6704
• chore: Bump actions/github-script from 8 to 9 by @​dependabot[bot] in #​6705
• chore: Bump JustinBeckwith/linkinator-action from 2.4.0 to 2.4.2 by @​dependabot[bot] in #​6706
• docs: correct return503OnClosing comment in route.js by @​mcollina in #​6712
• fix: enable diagnostics tracking for async error handlers by @​irzix in #​6458
• fix: ignore duplicate trailer completions by @​mcollina in #​6714
• feat: add support of onMaxParamLength by @​climba03003 in #​6716
• chore: introduce TSTyche for type testing by @​mrazauskas in #​6532
• docs(reference): grammar and readability fixes by @​Fdawgs in #​6710
• chore: update depedabot setting by @​climba03003 in #​6715
• fix: include hint and docs URL in FSTWRN004 warning message by @​aquie00t in #​6723
• ci(ci): do not pass secrets to reusable workflow by @​Fdawgs in #​6744
• docs: add fastify-intlayer to ecosystem documentation by @​aymericzip in #​6594
• chore: Bump concurrently from 9.2.1 to 10.0.0 by @​dependabot[bot] in #​6752
• docs(Errors): fix incorrect usage of root fastify inside plugin scope by @​Rpaudel379 in #​6731
• ci: add node 26 to test matrices by @​Fdawgs in #​6728
• docs(Warnings): remove retired FSTWRN002 warning code by @​leestana01 in #​6754
• fix: chunk large HTTP/2 buffer replies by @​mcollina in #​6746
• chore: migrate type tests to TSTyche assertions (part one) by @​mrazauskas in #​6726
• chore: migrate type tests to TSTyche assertions (part two) by @​mrazauskas in #​6727
• docs: fix doubled braces in serializerCompiler signature by @​DucMinhNe in #​6747
• docs: remove HackerOne reporting link by @​jhcpeixoto in #​6735
• refactor(decorate): replace find with some in hasKey for correct boolean semantics by @​aquie00t in #​6759
• fix: replace AssertionError with FST_ERR_PLUGIN_DEPENDENCY_NOT_REGISTERED in checkDependencies by @​aquie00t in #​6774
• docs(ecosystem): add @​inferdi/fastify by @​maxrendel in #​6742
• docs(typo): Write-Plugin.md by @​zakirimadullahprogrammer-tech in #​6776
• docs: fix duplicate anchor IDs causing broken TOC links by @​AliMahmoudDev in #​6770
• docs: add fastify-ata as a JSON Schema validator option by @​mertcanaltin in #​6733
• chore: rename type test files by @​mrazauskas in #​6762
• docs: update ajv-errors guidance by @​Herrtian in #​6741
• chore(warnings): correct duplicate 'not' typos in inline comments by @​mixelburg in #​6713
• docs: add fastify-param-schema-validation to ecosystem by @​Player1205 in #​6760
• docs(ecosystem): add @​thecodepace/fastify-http-query by @​Puppo in #​6785
• chore: Bump esbuild from 0.25.12 to 0.28.1 in /test/bundler/esbuild in the npm_and_yarn group across 1 directory by @​dependabot[bot] in #​6788
• fix: clear socket._meta after response to prevent keep-alive leaks by @​nerkoux in #​6799
• fix: avoid double slash when joining nested prefixes by @​rohithvegesna in #​6803
• docs(sponsors): Update sponsors list by removing two entries by @​Eomm in #​6792
• chore: Bump fastify-plugin from 5.1.0 to 6.0.0 by @​dependabot[bot] in #​6801
• chore(package.json): fix delvedor's personal url by @​Fdawgs in #​6808
• chore: replace http with https in urls by @​Fdawgs in #​6809
• chore: add new sponsor by @​Eomm in #​6813
• chore: Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​6812
• fix: hasRequestDecorator/hasReplyDecorator misses constructor-assigned built-in properties by @​LeSingh1 in #​6753
• docs: migrate Zod type provider to official @​fastify package by @​Tony133 in #​6686
• docs: add warning about empty string coercion with nullable types by @​ritambh888 in #​6452
• docs: fix incorrect code examples in Hooks and Server reference by @​rrodj in #​6622
• docs: update Serverless guide Dockerfile to a supported Node.js version by @​harish885 in #​6789
• docs(types): mark request metadata accessors as untrusted input by @​mcollina in #​6572
• Bumped v5.9.0 by @​Eomm in #​6816

New Contributors

• @​eddieran made their first contribution in #​6657
• @​irzix made their first contribution in #​6458
• @​aymericzip made their first contribution in #​6594
• @​Rpaudel379 made their first contribution in #​6731
• @​leestana01 made their first contribution in #​6754
• @​DucMinhNe made their first contribution in #​6747
• @​jhcpeixoto made their first contribution in #​6735
• @​maxrendel made their first contribution in #​6742
• @​zakirimadullahprogrammer-tech made their first contribution in #​6776
• @​AliMahmoudDev made their first contribution in #​6770
• @​mertcanaltin made their first contribution in #​6733
• @​Herrtian made their first contribution in #​6741
• @​mixelburg made their first contribution in #​6713
• @​Player1205 made their first contribution in #​6760
• @​Puppo made their first contribution in #​6785
• @​nerkoux made their first contribution in #​6799
• @​rohithvegesna made their first contribution in #​6803
• @​LeSingh1 made their first contribution in #​6753
• @​ritambh888 made their first contribution in #​6452
• @​rrodj made their first contribution in #​6622
• @​harish885 made their first contribution in #​6789

Full Changelog: fastify/fastify@v5.8.5...v5.9.0

v5.8.5

Compare Source

⚠️ Security Release

This fixes CVE CVE-2026-33806 GHSA-247c-9743-5963.

What's Changed

• chore: Fix port parsing by @​jsumners in #​6603
• chore: upgrade to typescript v6.0.2 by @​Tony133 in #​6605
• fix: restore trustProxy function for number and string types, add null check for socketAddr by @​mcollina in #​6613
• ci: reduce cron scheduled workflows from daily/weekly to monthly by @​Fdawgs in #​6623
• chore: Bump pnpm/action-setup from 4.2.0 to 5.0.0 by @​dependabot[bot] in #​6629
• chore: Bump markdownlint-cli2 from 0.21.0 to 0.22.0 by @​dependabot[bot] in #​6632
• chore: Bump borp from 0.21.0 to 1.0.0 by @​dependabot[bot] in #​6633
• chore: Bump actions/dependency-review-action from 4.8.3 to 4.9.0 by @​dependabot[bot] in #​6630
• docs(ecosystem): add @​pompelmi/fastify-plugin by @​SonoTommy in #​6610

New Contributors

• @​SonoTommy made their first contribution in #​6610

Full Changelog: fastify/fastify@v5.8.4...v5.8.5

v5.8.4

Compare Source

Full Changelog: fastify/fastify@v5.8.3...v5.8.4

v5.8.3

Compare Source

⚠️ Security Release

This fixes CVE CVE-2026-3635 GHSA-444r-cwp2-x5xf.

What's Changed

• docs(readme): add @​Tony133 to plugin team by @​Tony133 in #​6565
• Updated Plugins-Guide.md; Changed "fastify" to "instance" during plugin registration to showcase that it's added as a child by @​kyrylchenko in #​6566
• test: use fastify.test in test case by @​climba03003 in #​6568
• docs: use fastify.example in documentation by @​climba03003 in #​6567
• docs: add common performance degradation guidance by @​maxpetrusenko in #​6520
• docs(server): fix camelCase anchor links in TOC by @​Deepvamja in #​6530
• ci(link-checker): fix root-relative links resolution by @​barba-rossa in #​6535
• docs: update syntax markdown, absolute paths and links by @​Tony133 in #​6569
• docs: clarify content-type parser/schema mismatch is outside threat model by @​mcollina in #​6537
• docs: fix incorrect code examples in Reply and Request reference by @​mahmoodhamdi in #​6582
• docs: replace redirected npm.im http-errors link by @​mcollina in #​6588
• types: Allow port to be null in request type definition by @​TristanBarlow in #​6589
• docs: update links by @​Tony133 in #​6593
• ci(lock-threads): use shared lock-threads workflow by @​Fdawgs in #​6592

New Contributors

• @​kyrylchenko made their first contribution in #​6566
• @​maxpetrusenko made their first contribution in #​6520
• @​Deepvamja made their first contribution in #​6530
• @​barba-rossa made their first contribution in #​6535
• @​mahmoodhamdi made their first contribution in #​6582
• @​TristanBarlow made their first contribution in #​6589

Full Changelog: fastify/fastify@v5.8.2...v5.8.3

v5.8.2

[Compare S

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

📝 Walkthrough

Walkthrough

This pull request updates the fastify development dependency in package.json from version ^3.29.5 to ^5.0.0. This is a major version bump that advances the framework dependency across two major releases.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately summarizes the Fastify v5 dependency update and security focus.
Description check	✅ Passed	The description directly matches the Fastify upgrade and its security advisories.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/npm-fastify-vulnerability

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Line 42: The package currently depends on fastify "^5.0.0", which introduces
breaking API changes; either pin fastify to a v3/v4-compatible version or
migrate code to v5: update all fastify.listen(port) calls to fastify.listen({
port }), audit all fastify.register(...) usages and plugin imports to use v4+
naming (e.g., replace fastify-static with `@fastify/static`) and ensure
fastify-graceful-shutdown and `@types/fastify-static` are version-compatible or
replaced, and run a code search for ".listen(" without an options object and for
"fastify.register" to locate and fix remaining call sites.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a734e73c-622c-4dea-b0e0-8415aa45b687

📥 Commits

Reviewing files that changed from the base of the PR and between b3e94d6 and f2624b5.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• package.json

[coderabbitai]

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Critical breaking changes in Fastify v5 will cause test failures.

This major version jump from v3 to v5 introduces multiple breaking changes that affect the codebase:

1. listen() API signature changed (v4+): The test helper at sri-plugin/examples/wsi-test-helper.js:103 calls await fastify.listen(port), but Fastify v4+ requires an options object: await fastify.listen({ port }). This will throw a TypeError at runtime.

2. Plugin compatibility concerns: The related plugins fastify-static@^4.7.0 (line 44) and fastify-graceful-shutdown@^4.0.1 (line 43) need verification for Fastify v5 compatibility. Additionally, fastify-static was renamed to @fastify/static in the Fastify v4 ecosystem.

3. Type definitions: @types/fastify-static@^2.2.3 (line 40) may not provide correct types for Fastify v5.

Run the following script to verify Fastify usage patterns and check for additional breaking changes:

#!/bin/bash
# Description: Find all Fastify usage in the codebase and check for v3-style API calls

echo "=== Searching for Fastify instantiation and listen() calls ==="
rg -n -A 5 -B 2 'Fastify\s*\(' --type=js

echo -e "\n=== Searching for .listen( calls that may need migration ==="
rg -n -P '\.listen\s*\(\s*(?!{)' --type=js

echo -e "\n=== Searching for fastify plugin registrations ==="
rg -n 'fastify\.register\(' --type=js -A 2

Additionally, search the web for migration guidance:

Fastify v3 to v5 migration guide breaking changes

fastify-static v4 compatibility with Fastify v5

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 42, The package currently depends on fastify "^5.0.0",
which introduces breaking API changes; either pin fastify to a v3/v4-compatible
version or migrate code to v5: update all fastify.listen(port) calls to
fastify.listen({ port }), audit all fastify.register(...) usages and plugin
imports to use v4+ naming (e.g., replace fastify-static with `@fastify/static`)
and ensure fastify-graceful-shutdown and `@types/fastify-static` are
version-compatible or replaced, and run a code search for ".listen(" without an
options object and for "fastify.register" to locate and fix remaining call
sites.