fix(deps): update dependency fastify to v5.12.1 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
fastify (source)	5.6.1 → 5.12.1

---

Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream

CVE-2026-25224 / GHSA-mrq3-vjjr-p77c

More information

Details

Impact

A Denial of Service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation.

Patches

The issue is fixed in Fastify 5.7.3. Users should upgrade to 5.7.3 or later.

Workarounds

Avoid sending Web Streams from Fastify responses (e.g., ReadableStream or Response bodies). Use Node.js streams (stream.Readable) or buffered payloads instead until the project can upgrade.

References

• https://hackerone.com/reports/3524779

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/fastify/fastify/security/advisories/GHSA-mrq3-vjjr-p77c
• https://github.com/fastify/fastify/commit/eb11156396f6a5fedaceed0140aed2b7f026be37
• https://hackerone.com/reports/3524779
• https://nvd.nist.gov/vuln/detail/CVE-2026-25224
• https://github.com/advisories/GHSA-mrq3-vjjr-p77c

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Fastify's Content-Type header tab character allows body validation bypass

CVE-2026-25223 / GHSA-jx2c-rxcm-jvmq

More information

Details

Impact

A validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type.

For example, a request with Content-Type: application/json\ta will bypass JSON schema validation but still be parsed as JSON.

This vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints. The concrete impact depends on the handler implementation and the level of trust placed in the validated request body, but at the library level, this allows complete bypass of body validation for any handler using Content-Type-discriminated schemas.

This issue is a regression or missed edge case from the fix for a previously reported vulnerability.

Patches

This vulnerability has been patched in Fastify v5.7.2. All users should upgrade to this version or later immediately.

Workarounds

If upgrading is not immediately possible, user can implement a custom onRequest hook to reject requests containing tab characters in the Content-Type header:

fastify.addHook('onRequest', async (request, reply) => {
  const contentType = request.headers['content-type']
  if (contentType && contentType.includes('\t')) {
    reply.code(400).send({ error: 'Invalid Content-Type header' })
  }
})

Resources

• https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272
• https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125
• Fastify Validation and Serialization Documentation
• https://hackerone.com/reports/3464114

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq
• https://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821
• https://hackerone.com/reports/3464114
• https://fastify.dev/docs/latest/Reference/Validation-and-Serialization
• https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125
• https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272
• https://nvd.nist.gov/vuln/detail/CVE-2026-25223
• https://github.com/advisories/GHSA-jx2c-rxcm-jvmq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections

CVE-2026-3635 / GHSA-444r-cwp2-x5xf

More information

Details

Summary

When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.

Affected Versions

fastify <= 5.8.2

Impact

Applications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.

When trustProxy: true (trust everything), both host and protocol trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf
• https://nvd.nist.gov/vuln/detail/CVE-2026-3635
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.8.3
• https://www.cve.org/CVERecord?id=CVE-2026-3635
• https://github.com/advisories/GHSA-444r-cwp2-x5xf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header

CVE-2026-33806 / GHSA-247c-9743-5963

More information

Details

Summary

A validation bypass vulnerability exists in Fastify v5.x where request body validation schemas specified via schema.body.content can be completely circumvented by prepending a single space character (\x20) to the Content-Type header. The body is still parsed correctly as JSON (or any other content type), but schema validation is entirely skipped.
This is a regression introduced by commit f3d2bcb (fix for CVE-2025-32442).

Details

The vulnerability is a parser-validator differential between two independent code paths that process the raw Content-Type header differently.
Parser path (lib/content-type.js, line ~67) applies trimStart() before processing:

const type = headerValue.slice(0, sepIdx).trimStart().toLowerCase()
// ' application/json' → trimStart() → 'application/json' → body is parsed ✓

Validator path (lib/validation.js, line 272) splits on /[ ;]/ before trimming:

function getEssenceMediaType(header) {
  if (!header) return ''
  return header.split(/[ ;]/, 1)[0].trim().toLowerCase()
}
// ' application/json'.split(/[ ;]/, 1) → ['']  (splits on the leading space!)
// ''.trim() → ''
// context[bodySchema][''] → undefined → NO validator found → validation skipped!

The ContentType class applies trimStart() before processing, so the parser correctly identifies application/json and parses the body. However, getEssenceMediaType splits on /[ ;]/ before trimming, so the leading space becomes a split point, producing an empty string. The validator looks up a schema for content-type "", finds nothing, and skips validation entirely.
Regression source: Commit f3d2bcb (April 18, 2025) changed the split delimiter from ';' to /[ ;]/ to fix CVE-2025-32442. The old code (header.split(';', 1)[0].trim()) was not vulnerable to this vector because .trim() would correctly handle the leading space. The new regex-based split introduced the regression.

PoC

const fastify = require('fastify')({ logger: false });

fastify.post('/transfer', {
  schema: {
    body: {
      content: {
        'application/json': {
          schema: {
            type: 'object',
            required: ['amount', 'recipient'],
            properties: {
              amount: { type: 'number', maximum: 1000 },
              recipient: { type: 'string', maxLength: 50 },
              admin: { type: 'boolean', enum: [false] }
            },
            additionalProperties: false
          }
        }
      }
    }
  }
}, async (request) => {
  return { processed: true, data: request.body };
});

(async () => {
  await fastify.ready();

  // BLOCKED — normal request with invalid payload
  const res1 = await fastify.inject({
    method: 'POST',
    url: '/transfer',
    headers: { 'content-type': 'application/json' },
    payload: JSON.stringify({ amount: 9999, recipient: 'EVIL', admin: true })
  });
  console.log('Normal:', res1.statusCode);
  // → 400 FST_ERR_VALIDATION

  // BYPASS — single leading space
  const res2 = await fastify.inject({
    method: 'POST',
    url: '/transfer',
    headers: { 'content-type': ' application/json' },
    payload: JSON.stringify({ amount: 9999, recipient: 'EVIL', admin: true })
  });
  console.log('Leading space:', res2.statusCode);
  // → 200 (validation bypassed!)
  console.log('Body:', res2.body);

  await fastify.close();
})();

Output:

Normal: 400
Leading space: 200
Body: {"processed":true,"data":{"amount":9999,"recipient":"EVIL","admin":true}}

Impact

Any Fastify application that relies on schema.body.content (per-content-type body validation) to enforce data integrity or security constraints is affected. An attacker can bypass all body validation by adding a single space before the Content-Type value. The attack requires no authentication and has zero complexity — it is a single-character modification to an HTTP header.
This vulnerability is distinct from all previously patched content-type bypasses:

CVE	Vector	Patched in 5.8.4?
CVE-2025-32442	Casing / semicolon whitespace	✅ Yes
CVE-2026-25223	Tab character (\t)	✅ Yes
CVE-2026-3419	Trailing garbage after subtype	✅ Yes
This finding	Leading space (\x20)	❌ No

Recommended fix — add trimStart() before the split in getEssenceMediaType:

function getEssenceMediaType(header) {
  if (!header) return ''
  return header.trimStart().split(/[ ;]/, 1)[0].trim().toLowerCase()
}

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-247c-9743-5963
• https://nvd.nist.gov/vuln/detail/CVE-2025-32442
• https://github.com/fastify/fastify/commit/f3d2bcb3963cd570a582e5d39aab01a9ae692fe4
• https://github.com/fastify/fastify/releases/tag/v5.8.5
• https://github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc
• https://nvd.nist.gov/vuln/detail/CVE-2026-33806
• https://cna.openjsf.org/security-advisories.html
• https://github.com/advisories/GHSA-247c-9743-5963

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to schema validation bypass via root primitive coercion mismatch

CVE-2026-18504 / GHSA-w2qp-rph6-63g4

More information

Details

Impact

fastify before 5.12.1, when a route uses a root-level primitive body schema (for example an integer with a minimum and maximum) and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body "10" is coerced to the number 10 and passes an integer 1 to 10 schema, but request.body stays the string "10". An application that trusts the validated type is handed a value that did not satisfy the schema, which can bypass limits the application enforces on that typed value. Object and array body schemas are not affected, they coerce their members in place.

Patches

Upgrade to fastify 5.12.1.

Workarounds

Until you can upgrade, avoid relying on the validated type of a root primitive body. Wrap the value in an object schema (object properties are coerced in place), for example accept { "value": 10 } and read request.body.value, or re-check the type in the handler.

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-w2qp-rph6-63g4
• https://nvd.nist.gov/vuln/detail/CVE-2026-18504
• https://github.com/fastify/fastify/commit/1ef8a60c87e94f42f666aa15ad68957772a83655
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.1
• https://github.com/advisories/GHSA-w2qp-rph6-63g4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

fastify/fastify (fastify)

v5.12.1

Compare Source

⚠️ Security release

• Fix for GHSA-w2qp-rph6-63g4
• Fix for GHSA-3m5p-2c4r-xxw2

What's Changed

• [Backport 5.x] test: fix reply.mediaType by @​github-actions[bot] in #​6950
• [Backport 5.x] ci: allow backport in pr title by @​github-actions[bot] in #​6952
• [Backport 5.x] fix: run preClose hook exactly once per declaring instance by @​github-actions[bot] in #​6954
• [Backport 5.x] fix: report canonical route url for hidden prefix slash route by @​github-actions[bot] in #​6961

Full Changelog: fastify/fastify@v5.12.0...v5.12.1

v5.12.0

Compare Source

What's Changed

• chore(sponsor): add testmu ai by @​Eomm in #​6922
• docs: add per-route logging for Google Cloud Functions by @​slegarraga in #​6907
• test: remove @​sinonjs/fake-timers by @​climba03003 in #​6934
• [Backport 5.x] fix: remove raw response headers by @​github-actions[bot] in #​6939
• [Backport 5.x] test: use process-warning spyWarning for testing by @​github-actions[bot] in #​6945
• [Backport 5.x] feat: add Reply.prototype.mediaType by @​github-actions[bot] in #​6946
• [Backport 5.x] fix(content-type): return undefined for invalid media types by @​github-actions[bot] in #​6947

Full Changelog: fastify/fastify@v5.11.3...v5.12.0

v5.11.3

Compare Source

What's Changed

• fix: clear trailer state when removing all trailers by @​Ram-blip in #​6845
• docs: document percent-decoded route params as untrusted input by @​mcollina in #​6903
• docs(errors): document what the default error handler sends by @​basteez in #​6894
• docs(readme): fix grammar and cjs capitalization by @​minirang in #​6899
• fix: pass null instead of undefined to requestCompleted on success by @​lazerg in #​6837
• docs(encapsulation): clarify nested plugin scopes by @​jean-michelet in #​6893
• chore: Bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​6916
• chore: Bump fastify/workflows/.github/workflows/nested-quality.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​6917
• fix: recognize constructor-assigned built-in properties as decorator … by @​aquie00t in #​6892
• fix: reset lastIndex before testing global/sticky content-type RegExp parsers by @​zelinewang in #​6846

New Contributors

• @​minirang made their first contribution in #​6899
• @​lazerg made their first contribution in #​6837
• @​zelinewang made their first contribution in #​6846

Full Changelog: fastify/fastify@v5.11.2...v5.11.3

v5.11.2

Compare Source

v5.11.1

Compare Source

What's Changed

• fix: add http method override warning by @​jean-michelet in #​6879
• fix(types): allow explicit http2: false in server options by @​Tony133 in #​6888
• docs: clarify what attachValidation exposes on request.validationError by @​basteez in #​6891
• fix: do not force close in-flight connections when forceCloseConnections is 'idle' by @​aquie00t in #​6889

New Contributors

• @​basteez made their first contribution in #​6891

Full Changelog: fastify/fastify@v5.11.0...v5.11.1

v5.11.0

Compare Source

What's Changed

• chore: Bump markdownlint-cli2 from 0.22.1 to 0.23.0 by @​dependabot[bot] in #​6839
• fix: normalize method in findRoute by @​Ram-blip in #​6838
• docs: fix incorrect description for validateInput in Request.md by @​thePranav-kpk in #​6823
• feat: rfc10008 http query method by @​climba03003 in #​6832
• perf: reuse cached content types for response serialization by @​gurgunday in #​6854
• chore(sponsor): add n-ix by @​Eomm in #​6852
• ci: pin actions to commit-hash by @​Fdawgs in #​6853
• ci(dependabot): temporarily ignore typescript updates by @​Tony133 in #​6869
• style(types): enforce max line length by @​jean-michelet in #​6864
• docs(ecosystem): update fastify-prisma repo URL by @​zrosenbauer in #​6724
• docs(getting-started): align import with exported routes by @​Solaris-star in #​6859
• docs(server): fix contradictory requestIdHeader default by @​sobol-sudo in #​6872
• fix(validation): correctly update falsy values from validator by @​jackjin1997 in #​6483
• docs: specific warning suppression by @​jean-michelet in #​6871
• ci(links-check): pin linkinator server root to the workspace by @​aquie00t in #​6877
• docs: update TypeScript docs to reference Fastify 5.x by @​Sasireddy001 in #​6880
• docs: use async trailer handlers in Reply examples by @​Ram-blip in #​6856
• docs: fix logController migration example and links by @​aquie00t in #​6876
• fix: uncatchable throws in writeHead when using async hook by @​climba03003 in #​6881
• fix: honor quoted-string in Content-Type parameter values by @​aquie00t in #​6865
• chore(.npmrc): add min-release-age by @​Fdawgs in #​6873
• chore: Bump actions/setup-node from 6.4.0 to 7.0.0 by @​dependabot[bot] in #​6866
• chore: Bump actions/labeler from 6.2.0 to 7.0.0 by @​dependabot[bot] in #​6867

New Contributors

• @​Ram-blip made their first contribution in #​6838
• @​Solaris-star made their first contribution in #​6859
• @​sobol-sudo made their first contribution in #​6872
• @​jackjin1997 made their first contribution in #​6483
• @​Sasireddy001 made their first contribution in #​6880

Full Changelog: fastify/fastify@v5.10.0...v5.11.0

v5.10.0

Compare Source

v5.9.0

Compare Source

What's Changed

• feat: add request.mediaType by @​climba03003 in #​6653
• docs: remove deprecated leveldb plugin and update ecosystem by @​Tony133 in #​6661
• chore(sponsor): add bestforandroid by @​Eomm in #​6659
• ci: drop Node.js 20 from yarn matrix in package-manager-ci.yml by @​Tony133 in #​6662
• fix: prevent duplicate res.end in sendTrailer with sync callbacks by @​climba03003 in #​6676
• fix: avoid duplicate closeIdleConnections call on native servers by @​trivikr in #​6669
• fix: error.code not present on some routing errors by @​mcollina in #​6678
• fix: correct isCustomSerializerCompiler flag check by @​eddieran in #​6657
• fix: validate invalid route logLevel at registration by @​maxpetrusenko in #​6523
• docs: update contribution rules by @​Tony133 in #​6670
• fix: use ContentType parser for response schema lookup by @​UlisesGascon in #​6685
• ci(ci): use shared quality workflow by @​Fdawgs in #​6688
• fix(types): allow request.getValidationFunction() to return undefined by @​trivikr in #​6665
• fix: do not trust forwarded host/proto when socket is missing by @​mcollina in #​6684
• perf: defer ContentType parsing in getSchemaSerializer until needed by @​aquie00t in #​6692
• perf: cache parsed ContentType objects in ContentTypeParser by @​aquie00t in #​6694
• perf: add typeof guard before toString.call in send and onSendEnd by @​aquie00t in #​6693
• chore: Bump pnpm/action-setup from 5.0.0 to 6.0.4 by @​dependabot[bot] in #​6704
• chore: Bump actions/github-script from 8 to 9 by @​dependabot[bot] in #​6705
• chore: Bump JustinBeckwith/linkinator-action from 2.4.0 to 2.4.2 by @​dependabot[bot] in #​6706
• docs: correct return503OnClosing comment in route.js by @​mcollina in #​6712
• fix: enable diagnostics tracking for async error handlers by @​irzix in #​6458
• fix: ignore duplicate trailer completions by @​mcollina in #​6714
• feat: add support of onMaxParamLength by @​climba03003 in #​6716
• chore: introduce TSTyche for type testing by @​mrazauskas in #​6532
• docs(reference): grammar and readability fixes by @​Fdawgs in #​6710
• chore: update depedabot setting by @​climba03003 in #​6715
• fix: include hint and docs URL in FSTWRN004 warning message by @​aquie00t in #​6723
• ci(ci): do not pass secrets to reusable workflow by @​Fdawgs in #​6744
• docs: add fastify-intlayer to ecosystem documentation by @​aymericzip in #​6594
• chore: Bump concurrently from 9.2.1 to 10.0.0 by @​dependabot[bot] in #​6752
• docs(Errors): fix incorrect usage of root fastify inside plugin scope by @​Rpaudel379 in #​6731
• ci: add node 26 to test matrices by @​Fdawgs in #​6728
• docs(Warnings): remove retired FSTWRN002 warning code by @​leestana01 in #​6754
• fix: chunk large HTTP/2 buffer replies by @​mcollina in #​6746
• chore: migrate type tests to TSTyche assertions (part one) by @​mrazauskas in #​6726
• chore: migrate type tests to TSTyche assertions (part two) by @​mrazauskas in #​6727
• docs: fix doubled braces in serializerCompiler signature by @​DucMinhNe in #​6747
• docs: remove HackerOne reporting link by @​jhcpeixoto in #​6735
• refactor(decorate): replace find with some in hasKey for correct boolean semantics by @​aquie00t in #​6759
• fix: replace AssertionError with FST_ERR_PLUGIN_DEPENDENCY_NOT_REGISTERED in checkDependencies by @​aquie00t in #​6774
• docs(ecosystem): add @​inferdi/fastify by @​maxrendel in #​6742
• docs(typo): Write-Plugin.md by @​zakirimadullahprogrammer-tech in #​6776
• docs: fix duplicate anchor IDs causing broken TOC links by @​AliMahmoudDev in #​6770
• docs: add fastify-ata as a JSON Schema validator option by @​mertcanaltin in #​6733
• chore: rename type test files by @​mrazauskas in #​6762
• docs: update ajv-errors guidance by @​Herrtian in #​6741
• chore(warnings): correct duplicate 'not' typos in inline comments by @​mixelburg in #​6713
• docs: add fastify-param-schema-validation to ecosystem by @​Player1205 in #​6760
• docs(ecosystem): add @​thecodepace/fastify-http-query by @​Puppo in #​6785
• chore: Bump esbuild from 0.25.12 to 0.28.1 in /test/bundler/esbuild in the npm_and_yarn group across 1 directory by @​dependabot[bot] in #​6788
• fix: clear socket._meta after response to prevent keep-alive leaks by @​nerkoux in #​6799
• fix: avoid double slash when joining nested prefixes by @​rohithvegesna in #​6803
• docs(sponsors): Update sponsors list by removing two entries by @​Eomm in #​6792
• chore: Bump fastify-plugin from 5.1.0 to 6.0.0 by @​dependabot[bot] in #​6801
• chore(package.json): fix delvedor's personal url by @​Fdawgs in #​6808
• chore: replace http with https in urls by @​Fdawgs in #​6809
• chore: add new sponsor by @​Eomm in #​6813
• chore: Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​6812
• fix: hasRequestDecorator/hasReplyDecorator misses constructor-assigned built-in properties by @​LeSingh1 in #​6753
• docs: migrate Zod type provider to official @​fastify package by @​Tony133 in #​6686
• docs: add warning about empty string coercion with nullable types by @​ritambh888 in #​6452
• docs: fix incorrect code examples in Hooks and Server reference by @​rrodj in #​6622
• docs: update Serverless guide Dockerfile to a supported Node.js version by @​harish885 in #​6789
• docs(types): mark request metadata accessors as untrusted input by @​mcollina in #​6572
• Bumped v5.9.0 by @​Eomm in #​6816

New Contributors

• @​eddieran made their first contribution in #​6657
• @​irzix made their first contribution in #​6458
• @​aymericzip made their first contribution in #​6594
• @​Rpaudel379 made their first contribution in #​6731
• @​leestana01 made their first contribution in #​6754
• @​DucMinhNe made their first contribution in #​6747
• @​jhcpeixoto made their first contribution in #​6735
• @​maxrendel made their first contribution in #​6742
• @​zakirimadullahprogrammer-tech made their first contribution in #​6776
• @​AliMahmoudDev made their first contribution in #​6770
• @​mertcanaltin made their first contribution in #​6733
• @​Herrtian made their first contribution in #​6741
• @​mixelburg made their first contribution in #​6713
• @​Player1205 made their first contribution in #​6760
• @​Puppo made their first contribution in #​6785
• @​nerkoux made their first contribution in #​6799
• @​rohithvegesna made their first contribution in #​6803
• @​LeSingh1 made their first contribution in #​6753
• @​ritambh888 made their first contribution in #​6452
• @​rrodj made their first contribution in #​6622
• @​harish885 made their first contribution in #​6789

Full Changelog: fastify/fastify@v5.8.5...v5.9.0

v5.8.5

Compare Source

⚠️ Security Release

This fixes CVE CVE-2026-33806 GHSA-247c-9743-5963.

What's Changed

• chore: Fix port parsing by @​jsumners in #​6603
• chore: upgrade to typescript v6.0.2 by @​Tony133 in #​6605
• fix: restore trustProxy function for number and string types, add null check for socketAddr by @​mcollina in #​6613
• ci: reduce cron scheduled workflows from daily/weekly to monthly by @​Fdawgs in #​6623
• chore: Bump pnpm/action-setup from 4.2.0 to 5.0.0 by @​dependabot[bot] in #​6629
• chore: Bump markdownlint-cli2 from 0.21.0 to 0.22.0 by @​dependabot[bot] in #​6632
• chore: Bump borp from 0.21.0 to 1.0.0 by @​dependabot[bot] in #​6633
• chore: Bump actions/dependency-review-action from 4.8.3 to 4.9.0 by @​dependabot[bot] in #​6630
• docs(ecosystem): add @​pompelmi/fastify-plugin by @​SonoTommy in #​6610

New Contributors

• @​SonoTommy made their first contribution in #​6610

Full Changelog: fastify/fastify@v5.8.4...v5.8.5

v5.8.4

Compare Source

Full Changelog: fastify/fastify@v5.8.3...v5.8.4

v5.8.3

Compare Source

⚠️ Security Release

This fixes CVE CVE-2026-3635 GHSA-444r-cwp2-x5xf.

What's Changed

• docs(readme): add @​Tony133 to plugin team by @​Tony133 in #​6565
• Updated Plugins-Guide.md; Changed "fastify" to "instance" during plugin registration to showcase that it's added as a child by @​kyrylchenko in #​6566
• test: use fastify.test in test case by @​climba03003 in #​6568
• docs: use fastify.example in documentation by @​climba03003 in #​6567
• docs: add common performance degradation guidance by @​maxpetrusenko in #​6520
• docs(server): fix camelCase anchor links in TOC by @​Deepvamja in #​6530
• ci(link-checker): fix root-relative links resolution by @​barba-rossa in #​6535
• docs: update syntax markdown, absolute paths and links by @​Tony133 in #​6569
• docs: clarify content-type parser/schema mismatch is outside threat model by @​mcollina in #​6537
• docs: fix incorrect code examples in Reply and Request reference by @​mahmoodhamdi in #​6582
• docs: replace redirected npm.im http-errors link by @​mcollina in #​6588
• types: Allow port to be null in request type definition by @​TristanBarlow in #​6589
• docs: update links by @​Tony133 in #​6593
• ci(lock-threads): use shared lock-threads workflow by @​Fdawgs in #​6592

New Contributors

• @​kyrylchenko made their first contribution in #​6566
• @​maxpetrusenko made their first contribution in #​6520
• @​Deepvamja made their first contribution in #​6530
• @​barba-rossa made their first contribution in #​6535
• @​mahmoodhamdi made their first contribution in #​6582
• @​TristanBarlow made their first contribution in #​6589

Full Changelog: fastify/fastify@v5.8.2...v5.8.3

v5.8.2

Compare Source

What's Changed

• docs(ecosystem): add @​yeliex/fastify-problem-details by @​yeliex in #​6546
• Revert "chore: upgrade borp to v1.0.0" by @​climba03003 in #​6564
• docs: document body validation with custom content type parsers by @​mcollina in #​6556
• docs(ecosystem): add fastify-file-router by @​bhouston in #​6441
• docs: add fastify-svelte-view to Ecosystem list by @​matths in #​6453
• fix: anchor keyValuePairsReg to prevent quadratic backtracking by @​mcollina in #​6558
• docs: added note on handling of invalid URLs in setNotFoundHandler by @​leftieFriele in #​5661
• docs(guides): update codemod links by @​OluchiEzeifedikwa in #​6479
• docs: add @​glidemq/fastify to community plugins by @​avifenesh in #​6560

New Contributors

• @​yeliex made their first contribution in #​6546
• @​matths made their first contribution in #​6453
• @​leftieFriele made their first contribution in #​5661
• @​OluchiEzeifedikwa made their first contribution in #​6479
• [@​avifenesh](https://redirect.github.com/avife

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.