npm / fastify
fastify
What changed in fastify 5, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
5 breaking15 security7 new APIs and options9 performance56 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initfastify 592 changes
Breaking changes 5
Type definitions now restrict route lookup methods.
Raw response headers are removed.
Parsing of the content-type header now uses a strict parser and accepts only values in the form described by RFC 9110.
The types require a send() payload when a Reply type is specified.
The error parameter type is now unknown and can be configured with the generic TError.
Security 15
A security issue identified in the linked advisory was fixed.
Fixes the vulnerability identified by advisory GHSA-4mh8-r7rc-xpvc.
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
fastify vulnerable to header validation bypass via incomplete schema case normalization
fastify vulnerable to request body replacement via an async validation result collision
fastify vulnerable to request validation bypass via skipped boolean false schemas
Fixes four reported security advisories.
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
Fixes the vulnerabilities identified in the two linked security advisories.
Does not trust forwarded host or proto when the socket is missing.
Fixes CVE-2026-33806.
Fixes CVE-2026-3635; the notes do not specify the vulnerability’s behavior or impact.
Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation
Fixes the security vulnerability identified as CVE-2026-25224.
Fastify's Content-Type header tab character allows body validation bypass
New APIs and options 7
Adds Reply.prototype.mediaType.
Adds support for the HTTP QUERY method.
Introduces a log controller layer.
Adds support for onMaxParamLength.
Adds request.mediaType for accessing the request media type.
Adds first-class support for handler-level timeouts.
Request logging can now be conditional.
Performance 9
Parsed content-types now use a FIFO cache.
String bodies are decoded once instead of once per chunk.
Reduces content-type parser overhead.
Avoids redundant request-part reads during validation.
Reuses cached content types during response serialization.
Reduces per-request overhead in the request lifecycle.
Defers ContentType parsing in getSchemaSerializer until needed.
Caches parsed ContentType objects in ContentTypeParser.
Loading with a custom compiler is faster.
Fixes and other changes 56
An HTTP QUERY request with an empty body no longer causes an error.
Header names in propertyNames enum and const validation are lowercased.
An array passed for set-cookie is copied instead of stored directly.
reply.mediaType is now resolved from raw response headers.
Request child loggers no longer have their level reset.
Fixed the fastify.js version mismatch.
Runs the not-found preHandler regardless of registration order.
Reports the canonical route URL for a hidden prefix slash route.
Runs the preClose hook exactly once per declaring instance.
Invalid media types now return undefined.
Global and sticky content-type RegExp parsers reset lastIndex before testing.
Constructor-assigned built-in properties are now recognized as decorators.
Removing all trailers now clears trailer state.
Corrects the Fastify version in fastify.js.
When forceCloseConnections is 'idle', in-flight connections are no longer force-closed.
Adds a warning related to HTTP method override.
Server options types now allow explicitly setting http2 to false.
Fixes uncatchable throws in writeHead when an async hook is used.
Honors quoted-string syntax in Content-Type parameter values.
Correctly updates falsy values returned by the validator.
Clears socket._meta on reply.hijack() when onTimeout is registered.
Uses ContentType to detect json and charset in reply.send.
Derives request.port from request.host.
Enables diagnostics tracking for async error handlers.
checkDependencies now uses FST_ERR_PLUGIN_DEPENDENCY_NOT_REGISTERED instead of AssertionError.
Detects constructor-assigned built-in properties that were previously missed.
Detects constructor-assigned built-in properties that were previously missed.
Chunks large HTTP/2 buffer replies.
Corrects the isCustomSerializerCompiler flag check.
Avoids a double slash when joining nested prefixes.
Allows request.getValidationFunction() to return undefined in its types.
Uses the ContentType parser for response schema lookup.
Validates an invalid route logLevel during route registration.
Fixes routing errors that did not include error.code.
Prevents duplicate res.end calls when sendTrailer uses synchronous callbacks.
Clears socket._meta after the response to prevent keep-alive leaks.
Ignores duplicate trailer completions.
Fixes port parsing.
Restores the trustProxy function for number and string types and adds a null check for socketAddr.
The request type definition now allows port to be null.
Anchored the regular expression to prevent quadratic backtracking.
Fixes validation that allowed malformed Content-Types to pass.
Removes a format placeholder from the invalid media type error message.
Prevents routerOptions from being mutated across Fastify instances.
Accepts async route hooks in shorthand options.
AJV options type validation is fixed.
The status code is set before publishing to the diagnostics error channel.
Uses JSON.stringify for proper escaping of bad URLs.
The types for routerOptions.defaultRoute now align with runtime behavior.
Fastify options now respect the child logger factory.
Error handling is now consistent for custom validators in asynchronous validation contexts.
Web stream payloads are now handled in HEAD routes.
Fastify now accepts horizontal tab optional whitespace.
IPv6 hostnames are now parsed correctly.
Fixes error throwing in reply.
Custom error handlers now properly handle errors that are not FastifyErrors.