Fastify Release Notes

Name: Fastify
Brand: Fastify

Follow Fastify to add their release notes to your feed!

34 release notes curated from 1 source by the Releasebot Team. Last updated: Sep 5, 2026

Get this feed:

Sep 4, 2026
Date parsed from source:
Sep 4, 2026

First seen by Releasebot:
Sep 5, 2026
Fastify

v6.0.0-alpha.3

Fastify ships a security release with fixes for several GHSA vulnerabilities, plus updates to callNotFound behavior, content-type validation, docs links, and package cleanup in the latest alpha changelog.
Security release

Fix for GHSA-9q9j-q6p8-xq58

Fix for GHSA-hwr6-493r-vm6h

Fix for GHSA-p68q-wchp-6fh7

Fix for GHSA-667r-xxjv-c9mm

What's Changed

docs: fix broken links in Style-Guide.md by @Snehal-Pradhan in #6966

test(types): assert LogController.requestCompleted accepts an undefined error by @suzunn in #6875

fix: callNotFound should run not-found preHandler regardless of registration order by @mcollina in #6965

docs(ecosystem): remove deprecated http-wizard and rename fastify-better-sqlite3 by @ilteoood in #6972

chore: npm ignore remaining agent files by @lazerg in #6996

docs(contenttypeparser): new strict content-type validation by @bcomnes in #6925

New Contributors

@Snehal-Pradhan made their first contribution in #6966

@suzunn made their first contribution in #6875

@bcomnes made their first contribution in #6925

Full Changelog: v6.0.0-alpha.2...v6.0.0-alpha.3
Original source
Sep 4, 2026
Date parsed from source:
Sep 4, 2026

First seen by Releasebot:
Sep 5, 2026
Fastify

v5.12.2

Fastify ships a security release with fixes for multiple GHSA vulnerabilities and a not-found preHandler backport.

⚠️ Security release

Fix for GHSA-9q9j-q6p8-xq58

Fix for GHSA-hwr6-493r-vm6h

Fix for GHSA-p68q-wchp-6fh7

Fix for GHSA-667r-xxjv-c9mm

What's Changed

[Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @github-actions[bot] in #6973

[Backport 5.x] chore: npm ignore remaining agent files by @github-actions[bot] in #7003

Full Changelog: v5.12.1...v5.12.2
Original source
All of your release notes in one feed

Join Releasebot and get updates from Fastify and hundreds of other software products.

Create account
Get updates with:
Aug 19, 2026
Date parsed from source:
Aug 19, 2026

First seen by Releasebot:
Aug 19, 2026
Fastify

v6.0.0-alpha.2

Fastify ships a security-focused alpha update with fixes for reported vulnerabilities, cleaner route handling, a reply.mediaType test fix, and a preClose hook correction, while also trimming deprecated API notices ahead of the v6 cleanup.
Security release

Fix for GHSA-w2qp-rph6-63g4

Fix for GHSA-3m5p-2c4r-xxw2

What's Changed

test: fix reply.mediaType by @climba03003 in #6949

ci: allow backport in pr title by @climba03003 in #6948

fix: run preClose hook exactly once per declaring instance by @contactjawad in #6940

docs: remove deprecated-API notices ahead of v6 cleanup by @Tony133 in #6951

fix: report canonical route url for hidden prefix slash route by @paulkagiri in #6719

New Contributors

@contactjawad made their first contribution in #6940

@paulkagiri made their first contribution in #6719

Full Changelog: v6.0.0-alpha.1...v6.0.0-alpha.2
Original source
Aug 18, 2026
Date parsed from source:
Aug 18, 2026

First seen by Releasebot:
Aug 19, 2026
Fastify

v5.12.1

Fastify ships a security-focused 5.x patch with backported fixes for reply media type, preClose hooks, and canonical route URLs.
⚠️ Security release

Fix for GHSA-w2qp-rph6-63g4

Fix for GHSA-3m5p-2c4r-xxw2

What's Changed

[Backport 5.x] test: fix reply.mediaType by @github-actions[bot] in #6950

[Backport 5.x] ci: allow backport in pr title by @github-actions[bot] in #6952

[Backport 5.x] fix: run preClose hook exactly once per declaring instance by @github-actions[bot] in #6954

[Backport 5.x] fix: report canonical route url for hidden prefix slash route by @github-actions[bot] in #6961

Full Changelog: v5.12.0...v5.12.1
Original source
Aug 13, 2026
Date parsed from source:
Aug 13, 2026

First seen by Releasebot:
Aug 13, 2026
Fastify

v6.0.0-alpha.1

Fastify fixes raw response headers and adds Reply.prototype.mediaType in this release.
What's Changed

fix: remove raw response headers by @Ram-blip in #6860

test: use process-warning spyWarning for testing by @climba03003 in #6887

feat: add Reply.prototype.mediaType by @LiviaMedeiros in #6932

fix(content-type): return undefined for invalid media types by @jean-michelet in #6942

Full Changelog

v6.0.0-alpha.0...v6.0.0-alpha.1
Original source
Similar to Fastify with recent updates:
Aug 13, 2026
Date parsed from source:
Aug 13, 2026

First seen by Releasebot:
Aug 13, 2026
Fastify

v5.12.0

Fastify ships v5.12.0 with a new Reply.prototype.mediaType feature, plus content type validation fixes, raw response header cleanup, and updated docs for per-route logging in Google Cloud Functions.

What's Changed

chore(sponsor): add testmu ai by @Eomm in #6922

docs: add per-route logging for Google Cloud Functions by @slegarraga in #6907

test: remove @sinonjs/fake-timers by @climba03003 in #6934

[Backport 5.x] fix: remove raw response headers by @github-actions[bot] in #6939

[Backport 5.x] test: use process-warning spyWarning for testing by @github-actions[bot] in #6945

[Backport 5.x] feat: add Reply.prototype.mediaType by @github-actions[bot] in #6946

[Backport 5.x] fix(content-type): return undefined for invalid media types by @github-actions[bot] in #6947

Full Changelog: v5.11.3...v5.12.0
Original source
Aug 11, 2026
Date parsed from source:
Aug 11, 2026

First seen by Releasebot:
Aug 13, 2026
Fastify

v6.0.0-alpha.0

Fastify ships a major alpha cleanup with breaking type removals, updated logger and request context APIs, a higher minimum runtime, and default changes to error handling. It also fixes a misleading listening error and refreshes dependencies.
What's Changed

refactor: revert misleading error "Fastify instance is already listening" by @jean-michelet in #6098

refactor(types)!: remove deprecated FastifyPlugin type by @Tony133 in #6897

ci!: increase minimum runtime version by @climba03003 in #6904

refactor(types)!: remove deprecated FastifyLoggerInstance in favor of FastifyBaseLogger by @Tony133 in #6906

refactor!: remove Promise.withResolvers ponyfill by @jean-michelet in #6910

refactor(types)!: remove deprecated FastifyRequestContext and FastifyReplyContext types by @Tony133 in #6920

refactor!: disable error handler overrides by default by @jean-michelet in #6915

refactor(types)!: remove deprecated ValidationResult type alias by @Tony133 in #6914

chore(deps)!: upgrade undici v8.x by @Tony133 in #6921

refactor!: remove FSTDEP022 by @climba03003 in #6908

chore(sponsor): add testmu ai by @Eomm in #6922

docs: add per-route logging for Google Cloud Functions by @slegarraga in #6907

refactor!: remove FSTDEP023 deprecation by @jean-michelet in #6913

refactor!: remove FSTDEP024 deprecation by @jean-michelet in #6912

refactor!: remove FSTDEP025 by @jean-michelet in #6909

test: remove @sinonjs/fake-timers by @climba03003 in #6934

refactor(types)!: remove deprecated req in request.d.ts by @Tony133 in #6935

refactor(types)!: remove ResSerializerReply type by @jean-michelet in #6911

Full Changelog: v5.11.3...v6.0.0-alpha.0
Original source
Aug 8, 2026
Date parsed from source:
Aug 8, 2026

First seen by Releasebot:
Aug 9, 2026
Fastify

v5.11.3

Fastify ships v5.11.3 with bug fixes and documentation updates, including trailer state cleanup, safer request handling, built-in property decorator fixes, and clearer guidance on untrusted route params and default errors.
What's Changed

fix: clear trailer state when removing all trailers by @Ram-blip in #6845

docs: document percent-decoded route params as untrusted input by @mcollina in #6903

docs(errors): document what the default error handler sends by @basteez in #6894

docs(readme): fix grammar and cjs capitalization by @minirang in #6899

fix: pass null instead of undefined to requestCompleted on success by @lazerg in #6837

docs(encapsulation): clarify nested plugin scopes by @jean-michelet in #6893

chore: Bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @dependabot[bot] in #6916

chore: Bump fastify/workflows/.github/workflows/nested-quality.yml from 6.0.0 to 7.0.0 by @dependabot[bot] in #6917

fix: recognize constructor-assigned built-in properties as decorator … by @aquie00t in #6892

fix: reset lastIndex before testing global/sticky content-type RegExp parsers by @zelinewang in #6846

New Contributors

@minirang made their first contribution in #6899

@lazerg made their first contribution in #6837

@zelinewang made their first contribution in #6846

Full Changelog: v5.11.2...v5.11.3
Original source
Aug 8, 2026
Date parsed from source:
Aug 8, 2026

First seen by Releasebot:
Aug 3, 2026

Modified by Releasebot:
Aug 9, 2026
Fastify

v5.11.2

Fastify fixes the Fastify version in fastify.js in this release.

What's Changed

fix fastify version in fastify.js

Full Changelog: v5.11.1...v5.11.2
Original source
Aug 3, 2026
Date parsed from source:
Aug 3, 2026

First seen by Releasebot:
Aug 3, 2026
Fastify

v5.11.1

Fastify fixes connection handling, adds an HTTP method override warning, and improves HTTP/2 option typing.
What's Changed

fix: add http method override warning by @jean-michelet in #6879

fix(types): allow explicit http2: false in server options by @Tony133 in #6888

docs: clarify what attachValidation exposes on request.validationError by @basteez in #6891

fix: do not force close in-flight connections when forceCloseConnections is 'idle' by @aquie00t in #6889

New Contributors

@basteez made their first contribution in #6891

Full Changelog: v5.11.0...v5.11.1
Original source
Jul 30, 2026
Date parsed from source:
Jul 30, 2026

First seen by Releasebot:
Jul 30, 2026
Fastify

v5.11.0

Fastify releases 5.11.0 with a new RFC 10008 HTTP query method, improved response serialization performance, and fixes for route method normalization, validator falsy values, async hook writeHead throws, and quoted Content-Type parameters.
What's Changed

chore: Bump markdownlint-cli2 from 0.22.1 to 0.23.0 by @dependabot[bot] in #6839

fix: normalize method in findRoute by @Ram-blip in #6838

docs: fix incorrect description for validateInput in Request.md by @thePranav-kpk in #6823

feat: rfc10008 http query method by @climba03003 in #6832

perf: reuse cached content types for response serialization by @gurgunday in #6854

chore(sponsor): add n-ix by @Eomm in #6852

ci: pin actions to commit-hash by @Fdawgs in #6853

ci(dependabot): temporarily ignore typescript updates by @Tony133 in #6869

style(types): enforce max line length by @jean-michelet in #6864

docs(ecosystem): update fastify-prisma repo URL by @zrosenbauer in #6724

docs(getting-started): align import with exported routes by @Solaris-star in #6859

docs(server): fix contradictory requestIdHeader default by @sobol-sudo in #6872

fix(validation): correctly update falsy values from validator by @jackjin1997 in #6483

docs: specific warning suppression by @jean-michelet in #6871

ci(links-check): pin linkinator server root to the workspace by @aquie00t in #6877

docs: update TypeScript docs to reference Fastify 5.x by @Sasireddy001 in #6880

docs: use async trailer handlers in Reply examples by @Ram-blip in #6856

docs: fix logController migration example and links by @aquie00t in #6876

fix: uncatchable throws in writeHead when using async hook by @climba03003 in #6881

fix: honor quoted-string in Content-Type parameter values by @aquie00t in #6865

chore(.npmrc): add min-release-age by @Fdawgs in #6873

chore: Bump actions/setup-node from 6.4.0 to 7.0.0 by @dependabot[bot] in #6866

chore: Bump actions/labeler from 6.2.0 to 7.0.0 by @dependabot[bot] in #6867

New Contributors

@Ram-blip made their first contribution in #6838

@Solaris-star made their first contribution in #6859

@sobol-sudo made their first contribution in #6872

@jackjin1997 made their first contribution in #6483

@Sasireddy001 made their first contribution in #6880

Full Changelog: v5.10.0...v5.11.0
Original source
Jul 5, 2026
Date parsed from source:
Jul 5, 2026

First seen by Releasebot:
Jul 5, 2026
Fastify

v5.10.0

Fastify ships v5.10.0 with a new log controller layer, faster request lifecycle performance, and fixes for reply handling, JSON content detection, and request host and port behavior. The release also updates docs and drops Marko support in @fastify/view engines.
What's Changed

docs(type-providers): clarify as const usage by @smith558 in #6772

docs: fix broken and redirected links by @Eomm in #6817

docs: remove marko from @fastify/view engines (support dropped) by @EduardF1 in #6821

fix: clear socket._meta on reply.hijack() when onTimeout is registered by @nerkoux in #6810

docs: fix duplicate routeOptions entries in Request.md example by @thePranav-kpk in #6824

chore: Bump @types/node from 25.9.4 to 26.0.1 in the dev-dependencies-typescript group by @dependabot[bot] in #6829

docs(ecosystem): add @stitchapi/fastify to Community plugins by @rejifald in #6820

feat: introduce log controller layer by @Eomm in #6580

fix: use ContentType to detect json and charset in reply.send by @climba03003 in #6830

docs: fix incorrect defaults and code examples in Server.md by @Adit-Jain-srm in #6805

docs: fix incorrect hook count in Hooks.md by @thePranav-kpk in #6825

chore: Bump fast-json-stringify from 6.4.0 to 7.0.0 in the dependencies group across 1 directory by @dependabot[bot] in #6800

perf: reduce per-request overhead in the request lifecycle by @mcollina in #6831

fix: derive request.port from request.host by @mcollina in #6680

docs: update Logging.md with per-route log level info by @asppsa in #6627

docs(type-providers): update import for article consistency by @smith558 in #6771

New Contributors

@EduardF1 made their first contribution in #6821

@thePranav-kpk made their first contribution in #6824

@rejifald made their first contribution in #6820

@Adit-Jain-srm made their first contribution in #6805

@asppsa made their first contribution in #6627

Full Changelog: v5.9.0...v5.10.0
Original source
Jun 28, 2026
Date parsed from source:
Jun 28, 2026

First seen by Releasebot:
Jun 28, 2026
Fastify

v5.9.0

Fastify ships v5.9.0 with request.mediaType support, onMaxParamLength, and a range of fixes for routing, trailers, keep-alive leaks, HTTP/2 buffering, and decorator checks. It also improves content type handling, performance, and docs across the ecosystem.
What's Changed

feat: add request.mediaType by @climba03003 in #6653

docs: remove deprecated leveldb plugin and update ecosystem by @Tony133 in #6661

chore(sponsor): add bestforandroid by @Eomm in #6659

ci: drop Node.js 20 from yarn matrix in package-manager-ci.yml by @Tony133 in #6662

fix: prevent duplicate res.end in sendTrailer with sync callbacks by @climba03003 in #6676

fix: avoid duplicate closeIdleConnections call on native servers by @trivikr in #6669

fix: error.code not present on some routing errors by @mcollina in #6678

fix: correct isCustomSerializerCompiler flag check by @eddieran in #6657

fix: validate invalid route logLevel at registration by @maxpetrusenko in #6523

docs: update contribution rules by @Tony133 in #6670

fix: use ContentType parser for response schema lookup by @UlisesGascon in #6685

ci(ci): use shared quality workflow by @Fdawgs in #6688

fix(types): allow request.getValidationFunction() to return undefined by @trivikr in #6665

fix: do not trust forwarded host/proto when socket is missing by @mcollina in #6684

perf: defer ContentType parsing in getSchemaSerializer until needed by @aquie00t in #6692

perf: cache parsed ContentType objects in ContentTypeParser by @aquie00t in #6694

perf: add typeof guard before toString.call in send and onSendEnd by @aquie00t in #6693

chore: Bump pnpm/action-setup from 5.0.0 to 6.0.4 by @dependabot[bot] in #6704

chore: Bump actions/github-script from 8 to 9 by @dependabot[bot] in #6705

chore: Bump JustinBeckwith/linkinator-action from 2.4.0 to 2.4.2 by @dependabot[bot] in #6706

docs: correct return503OnClosing comment in route.js by @mcollina in #6712

fix: enable diagnostics tracking for async error handlers by @irzix in #6458

fix: ignore duplicate trailer completions by @mcollina in #6714

feat: add support of onMaxParamLength by @climba03003 in #6716

chore: introduce TSTyche for type testing by @mrazauskas in #6532

docs(reference): grammar and readability fixes by @Fdawgs in #6710

chore: update depedabot setting by @climba03003 in #6715

fix: include hint and docs URL in FSTWRN004 warning message by @aquie00t in #6723

ci(ci): do not pass secrets to reusable workflow by @Fdawgs in #6744

docs: add fastify-intlayer to ecosystem documentation by @aymericzip in #6594

chore: Bump concurrently from 9.2.1 to 10.0.0 by @dependabot[bot] in #6752

docs(Errors): fix incorrect usage of root fastify inside plugin scope by @Rpaudel379 in #6731

ci: add node 26 to test matrices by @Fdawgs in #6728

docs(Warnings): remove retired FSTWRN002 warning code by @leestana01 in #6754

fix: chunk large HTTP/2 buffer replies by @mcollina in #6746

chore: migrate type tests to TSTyche assertions (part one) by @mrazauskas in #6726

chore: migrate type tests to TSTyche assertions (part two) by @mrazauskas in #6727

docs: fix doubled braces in serializerCompiler signature by @DucMinhNe in #6747

docs: remove HackerOne reporting link by @jhcpeixoto in #6735

refactor(decorate): replace find with some in hasKey for correct boolean semantics by @aquie00t in #6759

fix: replace AssertionError with FST_ERR_PLUGIN_DEPENDENCY_NOT_REGISTERED in checkDependencies by @aquie00t in #6774

docs(ecosystem): add @inferdi/fastify by @maxrendel in #6742

docs(typo): Write-Plugin.md by @zakirimadullahprogrammer-tech in #6776

docs: fix duplicate anchor IDs causing broken TOC links by @AliMahmoudDev in #6770

docs: add fastify-ata as a JSON Schema validator option by @mertcanaltin in #6733

chore: rename type test files by @mrazauskas in #6762

docs: update ajv-errors guidance by @Herrtian in #6741

chore(warnings): correct duplicate 'not' typos in inline comments by @mixelburg in #6713

docs: add fastify-param-schema-validation to ecosystem by @Player1205 in #6760

docs(ecosystem): add @thecodepace/fastify-http-query by @Puppo in #6785

chore: Bump esbuild from 0.25.12 to 0.28.1 in /test/bundler/esbuild in the npm_and_yarn group across 1 directory by @dependabot[bot] in #6788

fix: clear socket._meta after response to prevent keep-alive leaks by @nerkoux in #6799

fix: avoid double slash when joining nested prefixes by @rohithvegesna in #6803

docs(sponsors): Update sponsors list by removing two entries by @Eomm in #6792

chore: Bump fastify-plugin from 5.1.0 to 6.0.0 by @dependabot[bot] in #6801

chore(package.json): fix delvedor's personal url by @Fdawgs in #6808

chore: replace http with https in urls by @Fdawgs in #6809

chore: add new sponsor by @Eomm in #6813

chore: Bump actions/checkout from 6 to 7 by @dependabot[bot] in #6812

fix: hasRequestDecorator/hasReplyDecorator misses constructor-assigned built-in properties by @LeSingh1 in #6753

docs: migrate Zod type provider to official @fastify package by @Tony133 in #6686

docs: add warning about empty string coercion with nullable types by @ritambh888 in #6452

docs: fix incorrect code examples in Hooks and Server reference by @rrodj in #6622

docs: update Serverless guide Dockerfile to a supported Node.js version by @harish885 in #6789

docs(types): mark request metadata accessors as untrusted input by @mcollina in #6572

Bumped v5.9.0 by @Eomm in #6816

New Contributors

@eddieran made their first contribution in #6657

@irzix made their first contribution in #6458

@aymericzip made their first contribution in #6594

@Rpaudel379 made their first contribution in #6731

@leestana01 made their first contribution in #6754

@DucMinhNe made their first contribution in #6747

@jhcpeixoto made their first contribution in #6735

@maxrendel made their first contribution in #6742

@zakirimadullahprogrammer-tech made their first contribution in #6776

@AliMahmoudDev made their first contribution in #6770

@mertcanaltin made their first contribution in #6733

@Herrtian made their first contribution in #6741

@mixelburg made their first contribution in #6713

@Player1205 made their first contribution in #6760

@Puppo made their first contribution in #6785

@nerkoux made their first contribution in #6799

@rohithvegesna made their first contribution in #6803

@LeSingh1 made their first contribution in #6753

@ritambh888 made their first contribution in #6452

@rrodj made their first contribution in #6622

@harish885 made their first contribution in #6789

Full Changelog: v5.8.5...v5.9.0
Original source
Apr 14, 2026
Date parsed from source:
Apr 14, 2026

First seen by Releasebot:
Apr 15, 2026
Fastify

v5.8.5

Fastify ships a security release that fixes CVE-2026-33806 and GHSA-247c-9743-5963, restores trustProxy handling for number and string types, and improves port parsing and socket address checks.
⚠️ Security Release

This fixes CVE CVE-2026-33806 GHSA-247c-9743-5963.

What's Changed

chore: Fix port parsing by @jsumners in #6603

chore: upgrade to typescript v6.0.2 by @Tony133 in #6605

fix: restore trustProxy function for number and string types, add null check for socketAddr by @mcollina in #6613

ci: reduce cron scheduled workflows from daily/weekly to monthly by @Fdawgs in #6623

chore: Bump pnpm/action-setup from 4.2.0 to 5.0.0 by @dependabot[bot] in #6629

chore: Bump markdownlint-cli2 from 0.21.0 to 0.22.0 by @dependabot[bot] in #6632

chore: Bump borp from 0.21.0 to 1.0.0 by @dependabot[bot] in #6633

chore: Bump actions/dependency-review-action from 4.8.3 to 4.9.0 by @dependabot[bot] in #6630

docs(ecosystem): add @pompelmi/fastify-plugin by @SonoTommy in #6610

New Contributors

@SonoTommy made their first contribution in #6610

Full Changelog: v5.8.4...v5.8.5
Original source
Mar 23, 2026
Date parsed from source:
Mar 23, 2026

First seen by Releasebot:
Mar 23, 2026
Fastify

v5.8.4

Fastify ships v5.8.4 release notes.

Full Changelog

v5.8.3...v5.8.4
Original source

Curated by the Releasebot team

Releasebot is an aggregator of official release notes from hundreds of software vendors and thousands of sources.

Our editorial process involves the manual review and audit of release notes procured with the help of automated systems.

About us Our methodology

Fastify Release Notes

v6.0.0-alpha.3

Security release

What's Changed

New Contributors

v5.12.2

⚠️ Security release

What's Changed

v6.0.0-alpha.2

Security release

What's Changed

New Contributors

v5.12.1

⚠️ Security release

What's Changed

v6.0.0-alpha.1

What's Changed

Full Changelog

Similar to Fastify with recent updates:

v5.12.0

What's Changed

v6.0.0-alpha.0

What's Changed

v5.11.3

What's Changed

New Contributors

v5.11.2

What's Changed

v5.11.1

What's Changed

New Contributors

v5.11.0

What's Changed

New Contributors

v5.10.0

What's Changed

New Contributors

v5.9.0

What's Changed

New Contributors

v5.8.5

⚠️ Security Release

What's Changed

New Contributors

v5.8.4

Full Changelog

Curated by the Releasebot team