Fastify Release Notes

⚠️ Security release

• Fix for https://github.com/fastify/fastify/security/advisories/GHSA-4mh8-r7rc-xpvc

What's Changed

• docs: add fastify-arktype to ecosystem by @BlairCurrey in https://github.com/fastify/fastify/pull/7000
• docs: link documentation style guide in contributing guidelines by @thePranav-kpk in https://github.com/fastify/fastify/pull/6819
• perf: reduce content-type parser overhead by @gurgunday in https://github.com/fastify/fastify/pull/7012
• perf: avoid redundant request-part reads during validation by @gurgunday in https://github.com/fastify/fastify/pull/7018
• chore(sponsor): add cloudways by @mcollina in https://github.com/fastify/fastify/pull/7021

New Contributors

• @BlairCurrey made their first contribution in https://github.com/fastify/fastify/pull/7000

Full Changelog: https://github.com/fastify/fastify/compare/v6.0.0-alpha.3...v6.0.0-alpha.4

⚠️ Security release

• Fix for https://github.com/fastify/fastify/security/advisories/GHSA-4mh8-r7rc-xpvc

What's Changed

• [Backport 5.x] perf: reduce content-type parser overhead by @github-actions[bot] in https://github.com/fastify/fastify/pull/7019
• [Backport 5.x] perf: avoid redundant request-part reads during validation by @github-actions[bot] in https://github.com/fastify/fastify/pull/7020

Full Changelog: https://github.com/fastify/fastify/compare/v5.12.4...v5.12.5

⚠️ Security release

• Fix for https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58
• Fix for https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6h
• Fix for https://github.com/fastify/fastify/security/advisories/GHSA-p68q-wchp-6fh7
• Fix for https://github.com/fastify/fastify/security/advisories/GHSA-667r-xxjv-c9mm

What's Changed

• docs: fix broken links in Style-Guide.md by @Snehal-Pradhan in https://github.com/fastify/fastify/pull/6966
• test(types): assert LogController.requestCompleted accepts an undefined error by @suzunn in https://github.com/fastify/fastify/pull/6875
• fix: callNotFound should run not-found preHandler regardless of registration order by @mcollina in https://github.com/fastify/fastify/pull/6965
• docs(ecosystem): remove deprecated http-wizard and rename fastify-better-sqlite3 by @ilteoood in https://github.com/fastify/fastify/pull/6972
• chore: npm ignore remaining agent files by @lazerg in https://github.com/fastify/fastify/pull/6996
• docs(contenttypeparser): new strict content-type validation by @bcomnes in https://github.com/fastify/fastify/pull/6925

New Contributors

• @Snehal-Pradhan made their first contribution in https://github.com/fastify/fastify/pull/6966
• @suzunn made their first contribution in https://github.com/fastify/fastify/pull/6875
• @bcomnes made their first contribution in https://github.com/fastify/fastify/pull/6925 …

⚠️ Security release

• Fix for https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58
• Fix for https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6h
• Fix for https://github.com/fastify/fastify/security/advisories/GHSA-p68q-wchp-6fh7
• Fix for https://github.com/fastify/fastify/security/advisories/GHSA-667r-xxjv-c9mm

What's Changed

• [Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @github-actions[bot] in https://github.com/fastify/fastify/pull/6973
• [Backport 5.x] chore: npm ignore remaining agent files by @github-actions[bot] in https://github.com/fastify/fastify/pull/7003

Full Changelog: https://github.com/fastify/fastify/compare/v5.12.1...v5.12.2

⚠️ Security release

• Fix for https://github.com/fastify/fastify/security/advisories/GHSA-w2qp-rph6-63g4
• Fix for https://github.com/fastify/fastify/security/advisories/GHSA-3m5p-2c4r-xxw2

What's Changed

• test: fix reply.mediaType by @climba03003 in https://github.com/fastify/fastify/pull/6949
• ci: allow backport in pr title by @climba03003 in https://github.com/fastify/fastify/pull/6948
• fix: run preClose hook exactly once per declaring instance by @contactjawad in https://github.com/fastify/fastify/pull/6940
• docs: remove deprecated-API notices ahead of v6 cleanup by @Tony133 in https://github.com/fastify/fastify/pull/6951
• fix: report canonical route url for hidden prefix slash route by @paulkagiri in https://github.com/fastify/fastify/pull/6719

New Contributors

• @contactjawad made their first contribution in https://github.com/fastify/fastify/pull/6940
• @paulkagiri made their first contribution in https://github.com/fastify/fastify/pull/6719

Full Changelog: https://github.com/fastify/fastify/compare/v6.0.0-alpha.1...v6.0.0-alpha.2

⚠️ Security release

• Fix for https://github.com/fastify/fastify/security/advisories/GHSA-w2qp-rph6-63g4
• Fix for https://github.com/fastify/fastify/security/advisories/GHSA-3m5p-2c4r-xxw2

What's Changed

• [Backport 5.x] test: fix reply.mediaType by @github-actions[bot] in https://github.com/fastify/fastify/pull/6950
• [Backport 5.x] ci: allow backport in pr title by @github-actions[bot] in https://github.com/fastify/fastify/pull/6952
• [Backport 5.x] fix: run preClose hook exactly once per declaring instance by @github-actions[bot] in https://github.com/fastify/fastify/pull/6954
• [Backport 5.x] fix: report canonical route url for hidden prefix slash route by @github-actions[bot] in https://github.com/fastify/fastify/pull/6961

Full Changelog: https://github.com/fastify/fastify/compare/v5.12.0...v5.12.1

What's Changed

• fix: remove raw response headers by @Ram-blip in https://github.com/fastify/fastify/pull/6860
• test: use process-warning spyWarning for testing by @climba03003 in https://github.com/fastify/fastify/pull/6887
• feat: add Reply.prototype.mediaType by @LiviaMedeiros in https://github.com/fastify/fastify/pull/6932
• fix(content-type): return undefined for invalid media types by @jean-michelet in https://github.com/fastify/fastify/pull/6942

Full Changelog: https://github.com/fastify/fastify/compare/v6.0.0-alpha.0...v6.0.0-alpha.1

What's Changed

• chore(sponsor): add testmu ai by @Eomm in https://github.com/fastify/fastify/pull/6922
• docs: add per-route logging for Google Cloud Functions by @slegarraga in https://github.com/fastify/fastify/pull/6907
• test: remove @sinonjs/fake-timers by @climba03003 in https://github.com/fastify/fastify/pull/6934
• [Backport 5.x] fix: remove raw response headers by @github-actions[bot] in https://github.com/fastify/fastify/pull/6939
• [Backport 5.x] test: use process-warning spyWarning for testing by @github-actions[bot] in https://github.com/fastify/fastify/pull/6945
• [Backport 5.x] feat: add Reply.prototype.mediaType by @github-actions[bot] in https://github.com/fastify/fastify/pull/6946
• [Backport 5.x] fix(content-type): return undefined for invalid media types by @github-actions[bot] in https://github.com/fastify/fastify/pull/6947

Full Changelog: https://github.com/fastify/fastify/compare/v5.11.3...v5.12.0

What's Changed

• refactor: revert misleading error "Fastify instance is already listening" by @jean-michelet in https://github.com/fastify/fastify/pull/6098
• refactor(types)!: remove deprecated FastifyPlugin type by @Tony133 in https://github.com/fastify/fastify/pull/6897
• ci!: increase minimum runtime version by @climba03003 in https://github.com/fastify/fastify/pull/6904
• refactor(types)!: remove deprecated FastifyLoggerInstance in favor of FastifyBaseLogger by @Tony133 in https://github.com/fastify/fastify/pull/6906
• refactor!: remove Promise.withResolvers ponyfill by @jean-michelet in https://github.com/fastify/fastify/pull/6910
• refactor(types)!: remove deprecated FastifyRequestContext and FastifyReplyContext types by @Tony133 in https://github.com/fastify/fastify/pull/6920
• refactor!: disable error handler overrides by default by @jean-michelet in https://github.com/fastify/fastify/pull/6915
• refactor(types)!: remove deprecated ValidationResult type alias by @Tony133 in https://github.com/fastify/fastify/pull/6914
• chore(deps)!: upgrade undici v8.x by @Tony133 in https://github.com/fastify/fastify/pull/6921
• refactor!: remove FSTDEP022 by @climba03003 in https://github.com/fastify/fastify/pull/6908
• chore(sponsor): add testmu ai by @Eomm in https://github.com/fastify/fastify/pull/6922
• docs: add per-route logging for Google Cloud Functions by @slegarraga in https://github.com/fastify/fastify/pull/6907 …

What's Changed

• fix: clear trailer state when removing all trailers by @Ram-blip in https://github.com/fastify/fastify/pull/6845
• docs: document percent-decoded route params as untrusted input by @mcollina in https://github.com/fastify/fastify/pull/6903
• docs(errors): document what the default error handler sends by @basteez in https://github.com/fastify/fastify/pull/6894
• docs(readme): fix grammar and cjs capitalization by @minirang in https://github.com/fastify/fastify/pull/6899
• fix: pass null instead of undefined to requestCompleted on success by @lazerg in https://github.com/fastify/fastify/pull/6837
• docs(encapsulation): clarify nested plugin scopes by @jean-michelet in https://github.com/fastify/fastify/pull/6893
• chore: Bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @dependabot[bot] in https://github.com/fastify/fastify/pull/6916
• chore: Bump fastify/workflows/.github/workflows/nested-quality.yml from 6.0.0 to 7.0.0 by @dependabot[bot] in https://github.com/fastify/fastify/pull/6917
• fix: recognize constructor-assigned built-in properties as decorator … by @aquie00t in https://github.com/fastify/fastify/pull/6892
• fix: reset lastIndex before testing global/sticky content-type RegExp parsers by @zelinewang in https://github.com/fastify/fastify/pull/6846

New Contributors

• @minirang made their first contribution in https://github.com/fastify/fastify/pull/6899 …

What's Changed

• fix: add http method override warning by @jean-michelet in https://github.com/fastify/fastify/pull/6879
• fix(types): allow explicit http2: false in server options by @Tony133 in https://github.com/fastify/fastify/pull/6888
• docs: clarify what attachValidation exposes on request.validationError by @basteez in https://github.com/fastify/fastify/pull/6891
• fix: do not force close in-flight connections when forceCloseConnections is 'idle' by @aquie00t in https://github.com/fastify/fastify/pull/6889

New Contributors

• @basteez made their first contribution in https://github.com/fastify/fastify/pull/6891

Full Changelog: https://github.com/fastify/fastify/compare/v5.11.0...v5.11.1

What's Changed

• chore: Bump markdownlint-cli2 from 0.22.1 to 0.23.0 by @dependabot[bot] in https://github.com/fastify/fastify/pull/6839
• fix: normalize method in findRoute by @Ram-blip in https://github.com/fastify/fastify/pull/6838
• docs: fix incorrect description for validateInput in Request.md by @thePranav-kpk in https://github.com/fastify/fastify/pull/6823
• feat: rfc10008 http query method by @climba03003 in https://github.com/fastify/fastify/pull/6832
• perf: reuse cached content types for response serialization by @gurgunday in https://github.com/fastify/fastify/pull/6854
• chore(sponsor): add n-ix by @Eomm in https://github.com/fastify/fastify/pull/6852
• ci: pin actions to commit-hash by @Fdawgs in https://github.com/fastify/fastify/pull/6853
• ci(dependabot): temporarily ignore typescript updates by @Tony133 in https://github.com/fastify/fastify/pull/6869
• style(types): enforce max line length by @jean-michelet in https://github.com/fastify/fastify/pull/6864
• docs(ecosystem): update fastify-prisma repo URL by @zrosenbauer in https://github.com/fastify/fastify/pull/6724
• docs(getting-started): align import with exported routes by @Solaris-star in https://github.com/fastify/fastify/pull/6859
• docs(server): fix contradictory requestIdHeader default by @sobol-sudo in https://github.com/fastify/fastify/pull/6872
• fix(validation): correctly update falsy values from validator by @jackjin1997 in https://github.com/fastify/fastify/pull/6483 …

What's Changed

• docs(type-providers): clarify as const usage by @smith558 in https://github.com/fastify/fastify/pull/6772
• docs: fix broken and redirected links by @Eomm in https://github.com/fastify/fastify/pull/6817
• docs: remove marko from @fastify/view engines (support dropped) by @EduardF1 in https://github.com/fastify/fastify/pull/6821
• fix: clear socket._meta on reply.hijack() when onTimeout is registered by @nerkoux in https://github.com/fastify/fastify/pull/6810
• docs: fix duplicate routeOptions entries in Request.md example by @thePranav-kpk in https://github.com/fastify/fastify/pull/6824
• chore: Bump @types/node from 25.9.4 to 26.0.1 in the dev-dependencies-typescript group by @dependabot[bot] in https://github.com/fastify/fastify/pull/6829
• docs(ecosystem): add @stitchapi/fastify to Community plugins by @rejifald in https://github.com/fastify/fastify/pull/6820
• feat: introduce log controller layer by @Eomm in https://github.com/fastify/fastify/pull/6580
• fix: use ContentType to detect json and charset in reply.send by @climba03003 in https://github.com/fastify/fastify/pull/6830
• docs: fix incorrect defaults and code examples in Server.md by @Adit-Jain-srm in https://github.com/fastify/fastify/pull/6805
• docs: fix incorrect hook count in Hooks.md by @thePranav-kpk in https://github.com/fastify/fastify/pull/6825 …

What's Changed

• feat: add request.mediaType by @climba03003 in https://github.com/fastify/fastify/pull/6653
• docs: remove deprecated leveldb plugin and update ecosystem by @Tony133 in https://github.com/fastify/fastify/pull/6661
• chore(sponsor): add bestforandroid by @Eomm in https://github.com/fastify/fastify/pull/6659
• ci: drop Node.js 20 from yarn matrix in package-manager-ci.yml by @Tony133 in https://github.com/fastify/fastify/pull/6662
• fix: prevent duplicate res.end in sendTrailer with sync callbacks by @climba03003 in https://github.com/fastify/fastify/pull/6676
• fix: avoid duplicate closeIdleConnections call on native servers by @trivikr in https://github.com/fastify/fastify/pull/6669
• fix: error.code not present on some routing errors by @mcollina in https://github.com/fastify/fastify/pull/6678
• fix: correct isCustomSerializerCompiler flag check by @eddieran in https://github.com/fastify/fastify/pull/6657
• fix: validate invalid route logLevel at registration by @maxpetrusenko in https://github.com/fastify/fastify/pull/6523
• docs: update contribution rules by @Tony133 in https://github.com/fastify/fastify/pull/6670
• fix: use ContentType parser for response schema lookup by @UlisesGascon in https://github.com/fastify/fastify/pull/6685
• ci(ci): use shared quality workflow by @Fdawgs in https://github.com/fastify/fastify/pull/6688 …

⚠️ Security Release

This fixes CVE CVE-2026-33806 https://github.com/fastify/fastify/security/advisories/GHSA-247c-9743-5963.

What's Changed

• chore: Fix port parsing by @jsumners in https://github.com/fastify/fastify/pull/6603
• chore: upgrade to typescript v6.0.2 by @Tony133 in https://github.com/fastify/fastify/pull/6605
• fix: restore trustProxy function for number and string types, add null check for socketAddr by @mcollina in https://github.com/fastify/fastify/pull/6613
• ci: reduce cron scheduled workflows from daily/weekly to monthly by @Fdawgs in https://github.com/fastify/fastify/pull/6623
• chore: Bump pnpm/action-setup from 4.2.0 to 5.0.0 by @dependabot[bot] in https://github.com/fastify/fastify/pull/6629
• chore: Bump markdownlint-cli2 from 0.21.0 to 0.22.0 by @dependabot[bot] in https://github.com/fastify/fastify/pull/6632
• chore: Bump borp from 0.21.0 to 1.0.0 by @dependabot[bot] in https://github.com/fastify/fastify/pull/6633
• chore: Bump actions/dependency-review-action from 4.8.3 to 4.9.0 by @dependabot[bot] in https://github.com/fastify/fastify/pull/6630
• docs(ecosystem): add @pompelmi/fastify-plugin by @SonoTommy in https://github.com/fastify/fastify/pull/6610

New Contributors

• @SonoTommy made their first contribution in https://github.com/fastify/fastify/pull/6610

Full Changelog: https://github.com/fastify/fastify/compare/v5.8.4...v5.8.5

⚠️ Security Release

This fixes CVE CVE-2026-3635 https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf.

What's Changed

• docs(readme): add @Tony133 to plugin team by @Tony133 in https://github.com/fastify/fastify/pull/6565
• Updated Plugins-Guide.md; Changed "fastify" to "instance" during plugin registration to showcase that it's added as a child by @kyrylchenko in https://github.com/fastify/fastify/pull/6566
• test: use fastify.test in test case by @climba03003 in https://github.com/fastify/fastify/pull/6568
• docs: use fastify.example in documentation by @climba03003 in https://github.com/fastify/fastify/pull/6567
• docs: add common performance degradation guidance by @maxpetrusenko in https://github.com/fastify/fastify/pull/6520
• docs(server): fix camelCase anchor links in TOC by @Deepvamja in https://github.com/fastify/fastify/pull/6530
• ci(link-checker): fix root-relative links resolution by @barba-rossa in https://github.com/fastify/fastify/pull/6535
• docs: update syntax markdown, absolute paths and links by @Tony133 in https://github.com/fastify/fastify/pull/6569
• docs: clarify content-type parser/schema mismatch is outside threat model by @mcollina in https://github.com/fastify/fastify/pull/6537
• docs: fix incorrect code examples in Reply and Request reference by @mahmoodhamdi in https://github.com/fastify/fastify/pull/6582 …

What's Changed

• docs(ecosystem): add @yeliex/fastify-problem-details by @yeliex in https://github.com/fastify/fastify/pull/6546
• Revert "chore: upgrade borp to v1.0.0" by @climba03003 in https://github.com/fastify/fastify/pull/6564
• docs: document body validation with custom content type parsers by @mcollina in https://github.com/fastify/fastify/pull/6556
• docs(ecosystem): add fastify-file-router by @bhouston in https://github.com/fastify/fastify/pull/6441
• docs: add fastify-svelte-view to Ecosystem list by @matths in https://github.com/fastify/fastify/pull/6453
• fix: anchor keyValuePairsReg to prevent quadratic backtracking by @mcollina in https://github.com/fastify/fastify/pull/6558
• docs: added note on handling of invalid URLs in setNotFoundHandler by @leftieFriele in https://github.com/fastify/fastify/pull/5661
• docs(guides): update codemod links by @OluchiEzeifedikwa in https://github.com/fastify/fastify/pull/6479
• docs: add @glidemq/fastify to community plugins by @avifenesh in https://github.com/fastify/fastify/pull/6560

New Contributors

• @yeliex made their first contribution in https://github.com/fastify/fastify/pull/6546
• @matths made their first contribution in https://github.com/fastify/fastify/pull/6453
• @leftieFriele made their first contribution in https://github.com/fastify/fastify/pull/5661
• @OluchiEzeifedikwa made their first contribution in https://github.com/fastify/fastify/pull/6479 …