# What changed in fastify

> 92 changes in fastify 5 from its official release notes, upgrade guides and advisories: 5 breaking, 15 security, 7 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/fastify/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## fastify 5

### Breaking changes

- Type definitions now restrict route lookup methods. (5.12.6) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.6)
- Raw response headers are removed. (5.12.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.0)
- Parsing of the content-type header now uses a strict parser and accepts only values in the form described by RFC 9110. (5.7.2) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.7.2)
- The types require a send() payload when a Reply type is specified. (5.7.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.7.0)
- The error parameter type is now unknown and can be configured with the generic TError. (5.6.2) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.6.2)

### Security

- A security issue identified in the linked advisory was fixed. (5.12.6) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.6)
- Fixes the vulnerability identified by advisory GHSA-4mh8-r7rc-xpvc. (5.12.5) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.5), [security advisory](https://github.com/advisories/GHSA-4MH8-R7RC-XPVC)
- fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers (5.12.2) — [security advisory](https://github.com/advisories/GHSA-P68Q-WCHP-6FH7)
- fastify vulnerable to header validation bypass via incomplete schema case normalization (5.12.2) — [security advisory](https://github.com/advisories/GHSA-9Q9J-Q6P8-XQ58)
- fastify vulnerable to request body replacement via an async validation result collision (5.12.2) — [security advisory](https://github.com/advisories/GHSA-667R-XXJV-C9MM)
- fastify vulnerable to request validation bypass via skipped boolean false schemas (5.12.2) — [security advisory](https://github.com/advisories/GHSA-HWR6-493R-VM6H)
- Fixes four reported security advisories. (5.12.2) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.2)
- fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count (5.12.1) — [security advisory](https://github.com/advisories/GHSA-3M5P-2C4R-XXW2)
- Fixes the vulnerabilities identified in the two linked security advisories. (5.12.1) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.1), [security advisory](https://github.com/advisories/GHSA-W2QP-RPH6-63G4)
- Does not trust forwarded host or proto when the socket is missing. (5.9.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.9.0)
- Fixes CVE-2026-33806. (5.8.5) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.8.5), [security advisory](https://github.com/advisories/GHSA-247C-9743-5963)
- Fixes CVE-2026-3635; the notes do not specify the vulnerability’s behavior or impact. (5.8.3) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.8.3), [security advisory](https://github.com/advisories/GHSA-444R-CWP2-X5XF)
- Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation (5.8.1) — [security advisory](https://github.com/advisories/GHSA-573F-X89G-HQP9)
- Fixes the security vulnerability identified as CVE-2026-25224. (5.7.3) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.7.3), [security advisory](https://github.com/advisories/GHSA-MRQ3-VJJR-P77C)
- Fastify's Content-Type header tab character allows body validation bypass (5.7.2) — [security advisory](https://github.com/advisories/GHSA-JX2C-RXCM-JVMQ)

### New APIs and options

- Adds Reply.prototype.mediaType. (5.12.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.0)
- Adds support for the HTTP QUERY method. (5.11.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.11.0)
- Introduces a log controller layer. (5.10.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.10.0)
- Adds support for onMaxParamLength. (5.9.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.9.0)
- Adds request.mediaType for accessing the request media type. (5.9.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.9.0)
- Adds first-class support for handler-level timeouts. (5.8.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.8.0)
- Request logging can now be conditional. (5.7.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.7.0)

### Performance

- Parsed content-types now use a FIFO cache. (5.12.6) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.6)
- String bodies are decoded once instead of once per chunk. (5.12.6) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.6)
- Reduces content-type parser overhead. (5.12.5) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.5)
- Avoids redundant request-part reads during validation. (5.12.5) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.5)
- Reuses cached content types during response serialization. (5.11.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.11.0)
- Reduces per-request overhead in the request lifecycle. (5.10.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.10.0)
- Defers ContentType parsing in getSchemaSerializer until needed. (5.9.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.9.0)
- Caches parsed ContentType objects in ContentTypeParser. (5.9.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.9.0)
- Loading with a custom compiler is faster. (5.7.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.7.0)

### Fixes and other changes

- An HTTP QUERY request with an empty body no longer causes an error. (5.12.6) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.6)
- Header names in propertyNames enum and const validation are lowercased. (5.12.6) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.6)
- An array passed for set-cookie is copied instead of stored directly. (5.12.6) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.6)
- reply.mediaType is now resolved from raw response headers. (5.12.6) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.6)
- Request child loggers no longer have their level reset. (5.12.6) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.6)
- Fixed the fastify.js version mismatch. (5.12.4) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.4)
- Runs the not-found preHandler regardless of registration order. (5.12.2) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.2)
- Reports the canonical route URL for a hidden prefix slash route. (5.12.1) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.1)
- Runs the preClose hook exactly once per declaring instance. (5.12.1) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.1)
- Invalid media types now return undefined. (5.12.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.12.0)
- Global and sticky content-type RegExp parsers reset lastIndex before testing. (5.11.3) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.11.3)
- Constructor-assigned built-in properties are now recognized as decorators. (5.11.3) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.11.3)
- Removing all trailers now clears trailer state. (5.11.3) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.11.3)
- Corrects the Fastify version in fastify.js. (5.11.2) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.11.2)
- When forceCloseConnections is 'idle', in-flight connections are no longer force-closed. (5.11.1) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.11.1)
- Adds a warning related to HTTP method override. (5.11.1) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.11.1)
- Server options types now allow explicitly setting http2 to false. (5.11.1) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.11.1)
- Fixes uncatchable throws in writeHead when an async hook is used. (5.11.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.11.0)
- Honors quoted-string syntax in Content-Type parameter values. (5.11.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.11.0)
- Correctly updates falsy values returned by the validator. (5.11.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.11.0)
- Clears socket._meta on reply.hijack() when onTimeout is registered. (5.10.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.10.0)
- Uses ContentType to detect json and charset in reply.send. (5.10.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.10.0)
- Derives request.port from request.host. (5.10.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.10.0)
- Enables diagnostics tracking for async error handlers. (5.9.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.9.0)
- checkDependencies now uses FST_ERR_PLUGIN_DEPENDENCY_NOT_REGISTERED instead of AssertionError. (5.9.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.9.0)
- Detects constructor-assigned built-in properties that were previously missed. (5.9.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.9.0)
- Detects constructor-assigned built-in properties that were previously missed. (5.9.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.9.0)
- Chunks large HTTP/2 buffer replies. (5.9.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.9.0)
- Corrects the isCustomSerializerCompiler flag check. (5.9.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.9.0)
- Avoids a double slash when joining nested prefixes. (5.9.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.9.0)
- Allows request.getValidationFunction() to return undefined in its types. (5.9.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.9.0)
- Uses the ContentType parser for response schema lookup. (5.9.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.9.0)
- Validates an invalid route logLevel during route registration. (5.9.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.9.0)
- Fixes routing errors that did not include error.code. (5.9.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.9.0)
- Prevents duplicate res.end calls when sendTrailer uses synchronous callbacks. (5.9.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.9.0)
- Clears socket._meta after the response to prevent keep-alive leaks. (5.9.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.9.0)
- Ignores duplicate trailer completions. (5.9.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.9.0)
- Fixes port parsing. (5.8.5) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.8.5)
- Restores the trustProxy function for number and string types and adds a null check for socketAddr. (5.8.5) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.8.5)
- The request type definition now allows port to be null. (5.8.3) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.8.3)
- Anchored the regular expression to prevent quadratic backtracking. (5.8.2) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.8.2)
- Fixes validation that allowed malformed Content-Types to pass. (5.8.1) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.8.1)
- Removes a format placeholder from the invalid media type error message. (5.8.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.8.0)
- Prevents routerOptions from being mutated across Fastify instances. (5.8.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.8.0)
- Accepts async route hooks in shorthand options. (5.8.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.8.0)
- AJV options type validation is fixed. (5.7.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.7.0)
- The status code is set before publishing to the diagnostics error channel. (5.7.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.7.0)
- Uses JSON.stringify for proper escaping of bad URLs. (5.7.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.7.0)
- The types for routerOptions.defaultRoute now align with runtime behavior. (5.7.0) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.7.0)
- Fastify options now respect the child logger factory. (5.6.2) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.6.2)
- Error handling is now consistent for custom validators in asynchronous validation contexts. (5.6.2) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.6.2)
- Web stream payloads are now handled in HEAD routes. (5.6.2) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.6.2)
- Fastify now accepts horizontal tab optional whitespace. (5.6.2) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.6.2)
- IPv6 hostnames are now parsed correctly. (5.6.2) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.6.2)
- Fixes error throwing in reply. (5.6.2) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.6.2)
- Custom error handlers now properly handle errors that are not FastifyErrors. (5.6.2) — [release notes](https://github.com/fastify/fastify/releases/tag/v5.6.2)