npm / @fastify/static
@fastify/static
What changed in @fastify/static 8 to 10, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-22.
2 breaking4 security1 new APIs and options10 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@fastify/static 1010 changes
Breaking changes 1
setHeaders now receives FastifyReply instead of Response; use reply helpers such as reply.header to set headers.
Security 2
Fixes the security issue tracked in advisory GHSA-8pvw-jcv7-9cmj; the notes do not describe its specific impact.
Fixes the security issue tracked by the linked advisory; the notes do not describe its impact or affected behavior.
New APIs and options 1
Adds the suppressWarning option.
Fixes and other changes 6
Files with # or ? in their names can now be served and listed.
Relative downloads now use the registered root.
Fixes a route guard and allowedPath bypass on case-insensitive filesystems.
Responses using preCompressed now set Vary: Accept-Encoding.
Unsupported deflate is now ignored for precompressed assets.
setHeaders can now override headers set during sending.
@fastify/static 96 changes
Security 2
Fixes this security vulnerability.
Fixes this security vulnerability.
Fixes and other changes 4
Propagates the return value from fastify.errorHandler.
Wildcard prefixes now work with route params.
Wildcard paths are resolved in encapsulated contexts.
Fixed cases where sendFile ignored option overrides.
@fastify/static 81 changes
Breaking changes 1
When serve is false and root is not defined, only files with absolute paths can be sent.