fix(deps): update dependency fastify to v5 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
fastify (source)	4.24.1 → 5.12.5

---

Fastify's Content-Type header tab character allows body validation bypass

CVE-2026-25223 / GHSA-jx2c-rxcm-jvmq

More information

Details

Impact

A validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type.

For example, a request with Content-Type: application/json\ta will bypass JSON schema validation but still be parsed as JSON.

This vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints. The concrete impact depends on the handler implementation and the level of trust placed in the validated request body, but at the library level, this allows complete bypass of body validation for any handler using Content-Type-discriminated schemas.

This issue is a regression or missed edge case from the fix for a previously reported vulnerability.

Patches

This vulnerability has been patched in Fastify v5.7.2. All users should upgrade to this version or later immediately.

Workarounds

If upgrading is not immediately possible, user can implement a custom onRequest hook to reject requests containing tab characters in the Content-Type header:

fastify.addHook('onRequest', async (request, reply) => {
  const contentType = request.headers['content-type']
  if (contentType && contentType.includes('\t')) {
    reply.code(400).send({ error: 'Invalid Content-Type header' })
  }
})

Resources

• https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272
• https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125
• Fastify Validation and Serialization Documentation
• https://hackerone.com/reports/3464114

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq
• https://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821
• https://hackerone.com/reports/3464114
• https://fastify.dev/docs/latest/Reference/Validation-and-Serialization
• https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125
• https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272
• https://nvd.nist.gov/vuln/detail/CVE-2026-25223
• https://github.com/advisories/GHSA-jx2c-rxcm-jvmq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream

CVE-2026-25224 / GHSA-mrq3-vjjr-p77c

More information

Details

Impact

A Denial of Service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation.

Patches

The issue is fixed in Fastify 5.7.3. Users should upgrade to 5.7.3 or later.

Workarounds

Avoid sending Web Streams from Fastify responses (e.g., ReadableStream or Response bodies). Use Node.js streams (stream.Readable) or buffered payloads instead until the project can upgrade.

References

• https://hackerone.com/reports/3524779

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/fastify/fastify/security/advisories/GHSA-mrq3-vjjr-p77c
• https://github.com/fastify/fastify/commit/eb11156396f6a5fedaceed0140aed2b7f026be37
• https://hackerone.com/reports/3524779
• https://nvd.nist.gov/vuln/detail/CVE-2026-25224
• https://github.com/advisories/GHSA-mrq3-vjjr-p77c

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections

CVE-2026-3635 / GHSA-444r-cwp2-x5xf

More information

Details

Summary

When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.

Affected Versions

fastify <= 5.8.2

Impact

Applications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.

When trustProxy: true (trust everything), both host and protocol trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf
• https://nvd.nist.gov/vuln/detail/CVE-2026-3635
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.8.3
• https://www.cve.org/CVERecord?id=CVE-2026-3635
• https://github.com/advisories/GHSA-444r-cwp2-x5xf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to schema validation bypass via root primitive coercion mismatch

CVE-2026-18504 / GHSA-w2qp-rph6-63g4

More information

Details

Impact

fastify before 5.12.1, when a route uses a root-level primitive body schema (for example an integer with a minimum and maximum) and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body "10" is coerced to the number 10 and passes an integer 1 to 10 schema, but request.body stays the string "10". An application that trusts the validated type is handed a value that did not satisfy the schema, which can bypass limits the application enforces on that typed value. Object and array body schemas are not affected, they coerce their members in place.

Patches

Upgrade to fastify 5.12.1.

Workarounds

Until you can upgrade, avoid relying on the validated type of a root primitive body. Wrap the value in an object schema (object properties are coerced in place), for example accept { "value": 10 } and read request.body.value, or re-check the type in the handler.

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-w2qp-rph6-63g4
• https://nvd.nist.gov/vuln/detail/CVE-2026-18504
• https://github.com/fastify/fastify/commit/1ef8a60c87e94f42f666aa15ad68957772a83655
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.1
• https://github.com/advisories/GHSA-w2qp-rph6-63g4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to header validation bypass via incomplete schema case normalization

CVE-2026-84428 / GHSA-9q9j-q6p8-xq58

More information

Details

Impact

Fastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level properties keys and the root required array, and did not lowercase the JSON Schema Draft 7 dependencies keyword (its trigger keys and dependent property names) or names in nested subschemas. As a result, a header schema that uses dependencies to require one header when another is present (for example X-Admin requiring X-Admin-Token) never matches the lowercased request headers, so the dependency assertion is silently skipped. An unauthenticated remote client can send the header that activates a privileged path while omitting the header the dependency was meant to require, bypassing a schema-enforced security control. The header schema is idiomatic, valid JSON Schema Draft 7, and no custom validator, malformed request, or misconfiguration is required.

Patches

Header-schema names are now normalized across all schema positions (properties, required, dependencies, dependentRequired, dependentSchemas, and nested subschemas). Patched in fastify 5.12.2. The fix is also included in the 6.0.0 release. Header schemas referenced through an external shared $ref (registered with addSchema) are not reached by this normalization and now emit an FSTSEC002 startup warning; inline the header schema to keep case-insensitive assertions in effect.

Workarounds

If upgrading is not immediately possible, write header-schema names in lowercase so the dependencies and other case-sensitive assertions match Node's lowercased request headers, or enforce the cross-header requirement in an onRequest or preValidation hook instead of the schema.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58
• https://nvd.nist.gov/vuln/detail/CVE-2026-84428
• https://github.com/fastify/fastify/commit/179619c8e99d54924309b9933402151ef9af37e0
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.2
• https://github.com/advisories/GHSA-9q9j-q6p8-xq58

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to request validation bypass via skipped boolean false schemas

CVE-2026-84469 / GHSA-hwr6-493r-vm6h

More information

Details

Impact

Fastify decided whether to validate a request part by checking its schema for JavaScript truthiness. JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance, but because false is falsy, a route that set body, querystring, params, or headers to false had that part left uncompiled: no validator was attached and the request reached the handler. An application that used false as a deny-all schema to make a route unreachable was therefore fully bypassed, and an unauthenticated remote client could reach the handler with any input. The same applied to the documented query alias for querystring. This is a complete bypass rather than a weak-schema issue, since false is the strongest JSON Schema assertion and must always fail.

Patches

Request-part schemas are now selected by an explicit presence check rather than truthiness, so a boolean false (or true) schema is compiled and enforced, including through the query alias. Patched in fastify 5.12.2. The fix is also included in the 6.0.0 release.

Workarounds

If upgrading is not immediately possible, express a deny-all request schema with an always-failing object schema instead of the boolean false (for example { "not": {} }), or reject the request in an onRequest hook.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6h
• https://nvd.nist.gov/vuln/detail/CVE-2026-84469
• https://github.com/fastify/fastify/commit/7de6e81697778f9f41bd327a3b1c5c9a0d9637b4
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.2
• https://github.com/advisories/GHSA-hwr6-493r-vm6h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

CVE-2026-76169 / GHSA-p68q-wchp-6fh7

More information

Details

Impact

Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the preHandler declared in its setNotFoundHandler(). When the request method has no route in the main router, a malformed request target reaches Fastify's internal not-found router before URL decoding and is dispatched through a single shared handler pointer, regardless of prefix and without the normal request lifecycle. An unauthenticated request to a public prefix can therefore reach an authentication-protected not-found handler registered under a different prefix and receive its full response, breaking prefix encapsulation and bypassing the authentication hook. Applications whose private or tenant fallbacks return protected data from a not-found handler are affected.

Patches

Patched in fastify 5.12.2. Malformed URLs are now routed through the configured onBadUrl and onMaxParamLength handlers so they fail closed before any application not-found handler runs, and the shared not-found handler pointer has been removed.

Workarounds

Reject malformed request targets before they reach the application, for example at an upstream proxy or gateway, and do not rely on a not-found handler to serve protected data. A global onRequest authentication hook does not mitigate this, because the malformed-URL path skips it.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-p68q-wchp-6fh7
• https://nvd.nist.gov/vuln/detail/CVE-2026-76169
• https://github.com/fastify/fastify/commit/93c239a380f3f2778bb7565fcdf777e91cfe1fbc
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.2
• https://github.com/advisories/GHSA-p68q-wchp-6fh7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to request body replacement via an async validation result collision

CVE-2026-84504 / GHSA-667r-xxjv-c9mm

More information

Details

Impact

Fastify runs a route's validator and, for a result shaped like { value, error }, unwraps it: an error becomes a validation failure and value replaces the request part. This convention is intended for synchronous custom compilers (for example Joi). A JSON Schema $async validator, however, resolves with the validated data itself, so Fastify applied the same unwrapping to it. If a request part validated by an $async schema contains a value property, Fastify replaced the whole request part with that nested value before the handler ran, so a value or error property in the payload was attacker-controlled. An application that dispatches operations from the validated request body could then act on data that never satisfied the route schema, leading to unauthorized state changes or disclosure. Reaching the vulnerable path requires the route to use an $async request schema.

Patches

Fastify no longer treats an asynchronous validation result as a { value, error } wrapper: an async validator's resolved value is used only to determine pass or fail, and it can no longer replace the request part or inject an error. The synchronous custom-compiler contract is unchanged. Patched in fastify 5.12.2 and 6.0.0.

Workarounds

If upgrading is not immediately possible, avoid $async request schemas, or perform the security-sensitive check in an onRequest or preHandler hook rather than relying on the schema-validated request part. Custom async validator compilers should signal failure by throwing (rejecting) rather than returning an { error } object.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-667r-xxjv-c9mm
• https://nvd.nist.gov/vuln/detail/CVE-2026-84504
• https://github.com/fastify/fastify/commit/f02d8d4ab1ab208f10819c4dc213595b06497833
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.2
• https://github.com/advisories/GHSA-667r-xxjv-c9mm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

CVE-2026-92081 / GHSA-4mh8-r7rc-xpvc

More information

Details

Impact

fastify crashes with an uncaught ERR_HTTP2_INVALID_CONNECTION_HEADERS exception when a route that registers a response trailer via reply.trailer() is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, terminating the Node.js process.

One unauthenticated HTTP/2 request to any route that uses trailers is enough to crash the server, dropping all in-flight requests, and the request can be repeated to keep the process down. Applications are affected only when HTTP/2 is enabled (http2: true) and at least one route registers a trailer. HTTP/1.x responses are not affected.

Patches

Upgrade to fastify 5.12.5 or later.

Workarounds

Avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/fastify/fastify/security/advisories/GHSA-4mh8-r7rc-xpvc
• https://nvd.nist.gov/vuln/detail/CVE-2026-92081
• https://github.com/fastify/fastify/issues/6574
• https://github.com/fastify/fastify/commit/ad06a4c3fe8a944a904f38068249b18b8f552e90
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.5
• https://github.com/advisories/GHSA-4mh8-r7rc-xpvc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

fastify/fastify (fastify)

v5.12.5

Compare Source

⚠️ Security release

• Fix for GHSA-4mh8-r7rc-xpvc

What's Changed

• [Backport 5.x] perf: reduce content-type parser overhead by @​github-actions[bot] in #​7019
• [Backport 5.x] perf: avoid redundant request-part reads during validation by @​github-actions[bot] in #​7020

Full Changelog: fastify/fastify@v5.12.4...v5.12.5

v5.12.4

Compare Source

Fixed the fastify.js version mismatch.

Full Changelog: fastify/fastify@v5.12.2...v5.12.4

v5.12.3

Compare Source

v5.12.2

Compare Source

⚠️ Security release

• Fix for GHSA-9q9j-q6p8-xq58
• Fix for GHSA-hwr6-493r-vm6h
• Fix for GHSA-p68q-wchp-6fh7
• Fix for GHSA-667r-xxjv-c9mm

What's Changed

• [Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @​github-actions[bot] in #​6973
• [Backport 5.x] chore: npm ignore remaining agent files by @​github-actions[bot] in #​7003

Full Changelog: fastify/fastify@v5.12.1...v5.12.2

v5.12.1

Compare Source

⚠️ Security release

• Fix for GHSA-w2qp-rph6-63g4
• Fix for GHSA-3m5p-2c4r-xxw2

What's Changed

• [Backport 5.x] test: fix reply.mediaType by @​github-actions[bot] in #​6950
• [Backport 5.x] ci: allow backport in pr title by @​github-actions[bot] in #​6952
• [Backport 5.x] fix: run preClose hook exactly once per declaring instance by @​github-actions[bot] in #​6954
• [Backport 5.x] fix: report canonical route url for hidden prefix slash route by @​github-actions[bot] in #​6961

Full Changelog: fastify/fastify@v5.12.0...v5.12.1

v5.12.0

Compare Source

What's Changed

• chore(sponsor): add testmu ai by @​Eomm in #​6922
• docs: add per-route logging for Google Cloud Functions by @​slegarraga in #​6907
• test: remove @​sinonjs/fake-timers by @​climba03003 in #​6934
• [Backport 5.x] fix: remove raw response headers by @​github-actions[bot] in #​6939
• [Backport 5.x] test: use process-warning spyWarning for testing by @​github-actions[bot] in #​6945
• [Backport 5.x] feat: add Reply.prototype.mediaType by @​github-actions[bot] in #​6946
• [Backport 5.x] fix(content-type): return undefined for invalid media types by @​github-actions[bot] in #​6947

Full Changelog: fastify/fastify@v5.11.3...v5.12.0

v5.11.3

Compare Source

What's Changed

• fix: clear trailer state when removing all trailers by @​Ram-blip in #​6845
• docs: document percent-decoded route params as untrusted input by @​mcollina in #​6903
• docs(errors): document what the default error handler sends by @​basteez in #​6894
• docs(readme): fix grammar and cjs capitalization by @​minirang in #​6899
• fix: pass null instead of undefined to requestCompleted on success by @​lazerg in #​6837
• docs(encapsulation): clarify nested plugin scopes by @​jean-michelet in #​6893
• chore: Bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​6916
• chore: Bump fastify/workflows/.github/workflows/nested-quality.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​6917
• fix: recognize constructor-assigned built-in properties as decorator … by @​aquie00t in #​6892
• fix: reset lastIndex before testing global/sticky content-type RegExp parsers by @​zelinewang in #​6846

New Contributors

• @​minirang made their first contribution in #​6899
• @​lazerg made their first contribution in #​6837
• @​zelinewang made their first contribution in #​6846

Full Changelog: fastify/fastify@v5.11.2...v5.11.3

v5.11.2

Compare Source

v5.11.1

Compare Source

What's Changed

• fix: add http method override warning by @​jean-michelet in #​6879
• fix(types): allow explicit http2: false in server options by @​Tony133 in #​6888
• docs: clarify what attachValidation exposes on request.validationError by @​basteez in #​6891
• fix: do not force close in-flight connections when forceCloseConnections is 'idle' by @​aquie00t in #​6889

New Contributors

• @​basteez made their first contribution in #​6891

Full Changelog: fastify/fastify@v5.11.0...v5.11.1

v5.11.0

Compare Source

What's Changed

• chore: Bump markdownlint-cli2 from 0.22.1 to 0.23.0 by @​dependabot[bot] in #​6839
• fix: normalize method in findRoute by @​Ram-blip in #​6838
• docs: fix incorrect description for validateInput in Request.md by @​thePranav-kpk in #​6823
• feat: rfc10008 http query method by @​climba03003 in #​6832
• perf: reuse cached content types for response serialization by @​gurgunday in #​6854
• chore(sponsor): add n-ix by @​Eomm in #​6852
• ci: pin actions to commit-hash by @​Fdawgs in #​6853
• ci(dependabot): temporarily ignore typescript updates by @​Tony133 in #​6869
• style(types): enforce max line length by @​jean-michelet in #​6864
• docs(ecosystem): update fastify-prisma repo URL by @​zrosenbauer in #​6724
• docs(getting-started): align import with exported routes by @​Solaris-star in #​6859
• docs(server): fix contradictory requestIdHeader default by @​sobol-sudo in #​6872
• fix(validation): correctly update falsy values from validator by @​jackjin1997 in #​6483
• docs: specific warning suppression by @​jean-michelet in #​6871
• ci(links-check): pin linkinator server root to the workspace by @​aquie00t in #​6877
• docs: update TypeScript docs to reference Fastify 5.x by @​Sasireddy001 in #​6880
• docs: use async trailer handlers in Reply examples by @​Ram-blip in #​6856
• docs: fix logController migration example and links by @​aquie00t in #​6876
• fix: uncatchable throws in writeHead when using async hook by @​climba03003 in #​6881
• fix: honor quoted-string in Content-Type parameter values by @​aquie00t in #​6865
• chore(.npmrc): add min-release-age by @​Fdawgs in #​6873
• chore: Bump actions/setup-node from 6.4.0 to 7.0.0 by @​dependabot[bot] in #​6866
• chore: Bump actions/labeler from 6.2.0 to 7.0.0 by @​dependabot[bot] in #​6867

New Contributors

• @​Ram-blip made their first contribution in #​6838
• @​Solaris-star made their first contribution in #​6859
• @​sobol-sudo made their first contribution in #​6872
• @​jackjin1997 made their first contribution in #​6483
• @​Sasireddy001 made their first contribution in #​6880

Full Changelog: fastify/fastify@v5.10.0...v5.11.0

v5.10.0

Compare Source

v5.9.0

Compare Source

What's Changed

• feat: add request.mediaType by @​climba03003 in #​6653
• docs: remove deprecated leveldb plugin and update ecosystem by @​Tony133 in #​6661
• chore(sponsor): add bestforandroid by @​Eomm in #​6659
• ci: drop Node.js 20 from yarn matrix in package-manager-ci.yml by @​Tony133 in #​6662
• fix: prevent duplicate res.end in sendTrailer with sync callbacks by @​climba03003 in #​6676
• fix: avoid duplicate closeIdleConnections call on native servers by @​trivikr in #​6669
• fix: error.code not present on some routing errors by @​mcollina in #​6678
• fix: correct isCustomSerializerCompiler flag check by @​eddieran in #​6657
• fix: validate invalid route logLevel at registration by @​maxpetrusenko in #​6523
• docs: update contribution rules by @​Tony133 in #​6670
• fix: use ContentType parser for response schema lookup by @​UlisesGascon in #​6685
• ci(ci): use shared quality workflow by @​Fdawgs in #​6688
• fix(types): allow request.getValidationFunction() to return undefined by @​trivikr in #​6665
• fix: do not trust forwarded host/proto when socket is missing by @​mcollina in #​6684
• perf: defer ContentType parsing in getSchemaSerializer until needed by @​aquie00t in #​6692
• perf: cache parsed ContentType objects in ContentTypeParser by @​aquie00t in #​6694
• perf: add typeof guard before toString.call in send and onSendEnd by @​aquie00t in #​6693
• chore: Bump pnpm/action-setup from 5.0.0 to 6.0.4 by @​dependabot[bot] in #​6704
• chore: Bump actions/github-script from 8 to 9 by @​dependabot[bot] in #​6705
• chore: Bump JustinBeckwith/linkinator-action from 2.4.0 to 2.4.2 by @​dependabot[bot] in #​6706
• docs: correct return503OnClosing comment in route.js by @​mcollina in #​6712
• fix: enable diagnostics tracking for async error handlers by @​irzix in #​6458
• fix: ignore duplicate trailer completions by @​mcollina in #​6714
• feat: add support of onMaxParamLength by @​climba03003 in #​6716
• chore: introduce TSTyche for type testing by @​mrazauskas in #​6532
• docs(reference): grammar and readability fixes by @​Fdawgs in #​6710
• chore: update depedabot setting by @​climba03003 in #​6715
• fix: include hint and docs URL in FSTWRN004 warning message by @​aquie00t in #​6723
• ci(ci): do not pass secrets to reusable workflow by @​Fdawgs in #​6744
• docs: add fastify-intlayer to ecosystem documentation by @​aymericzip in #​6594
• chore: Bump concurrently from 9.2.1 to 10.0.0 by @​dependabot[bot] in #​6752
• docs(Errors): fix incorrect usage of root fastify inside plugin scope by @​Rpaudel379 in #​6731
• ci: add node 26 to test matrices by @​Fdawgs in #​6728
• docs(Warnings): remove retired FSTWRN002 warning code by @​leestana01 in #​6754
• fix: chunk large HTTP/2 buffer replies by @​mcollina in #​6746
• chore: migrate type tests to TSTyche assertions (part one) by @​mrazauskas in #​6726
• chore: migrate type tests to TSTyche assertions (part two) by @​mrazauskas in #​6727
• docs: fix doubled braces in serializerCompiler signature by @​DucMinhNe in #​6747
• docs: remove HackerOne reporting link by @​jhcpeixoto in #​6735
• refactor(decorate): replace find with some in hasKey for correct boolean semantics by @​aquie00t in #​6759
• fix: replace AssertionError with FST_ERR_PLUGIN_DEPENDENCY_NOT_REGISTERED in checkDependencies by @​aquie00t in #​6774
• docs(ecosystem): add @​inferdi/fastify by @​maxrendel in #​6742
• docs(typo): Write-Plugin.md by @​zakirimadullahprogrammer-tech in #​6776
• docs: fix duplicate anchor IDs causing broken TOC links by @​AliMahmoudDev in #​6770
• docs: add fastify-ata as a JSON Schema validator option by @​mertcanaltin in #​6733
• chore: rename type test files by @​mrazauskas in #​6762
• docs: update ajv-errors guidance by @​Herrtian in #​6741
• chore(warnings): correct duplicate 'not' typos in inline comments by @​mixelburg in #​6713
• docs: add fastify-param-schema-validation to ecosystem by @​Player1205 in #​6760
• docs(ecosystem): add @​thecodepace/fastify-http-query by @​Puppo in #​6785
• chore: Bump esbuild from 0.25.12 to 0.28.1 in /test/bundler/esbuild in the npm_and_yarn group across 1 directory by @​dependabot[bot] in #​6788
• fix: clear socket._meta after response to prevent keep-alive leaks by @​nerkoux in #​6799
• fix: avoid double slash when joining nested prefixes by @​rohithvegesna in #​6803
• docs(sponsors): Update sponsors list by removing two entries by @​Eomm in #​6792
• chore: Bump fastify-plugin from 5.1.0 to 6.0.0 by @​dependabot[bot] in #​6801
• chore(package.json): fix delvedor's personal url by @​Fdawgs in #​6808
• chore: replace http with https in urls by @​Fdawgs in #​6809
• chore: add new sponsor by @​Eomm in #​6813
• chore: Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​6812
• fix: hasRequestDecorator/hasReplyDecorator misses constructor-assigned built-in properties by @​LeSingh1 in #​6753
• docs: migrate Zod type provider to official @​fastify package by @​Tony133 in #​6686
• docs: add warning about empty string coercion with nullable types by @​ritambh888 in #​6452
• docs: fix incorrect code examples in Hooks and Server reference by @​rrodj in #​6622
• docs: update Serverless guide Dockerfile to a supported Node.js version by @​harish885 in #​6789
• docs(types): mark request metadata accessors as untrusted input by @​mcollina in #​6572
• Bumped v5.9.0 by @​Eomm in #​6816

New Contributors

• @​eddieran made their first contribution in #​6657
• @​irzix made their first contribution in #​6458
• @​aymericzip made their first contribution in #​6594
• @​Rpaudel379 made their first contribution in #​6731
• @​leestana01 made their first contribution in #​6754
• @​DucMinhNe made their first contribution in #​6747
• @​jhcpeixoto made their first contribution in #​6735
• @​maxrendel made their first contribution in #​6742
• @​zakirimadullahprogrammer-tech made their first contribution in #​6776
• @​AliMahmoudDev made their first contribution in #​6770
• @​mertcanaltin made their first contribution in #​6733
• @​Herrtian made their first contribution in #​6741
• @​mixelburg made their first contribution in #​6713
• @​Player1205 made their first contribution in #​6760
• @​Puppo made their first contribution in #​6785
• @​nerkoux made their first contribution in [#​6799](https://redirect.github.com/f

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn cli npm v12.2.0 does not support Node.js v18.20.8. This version of npm supports the following node versions: `^22.22.2 || ^24.15.0 || >=26.0.0`. You can find the latest version at https://nodejs.org/.
npm error code ERR_REQUIRE_ESM
npm error require() of ES Module /opt/containerbase/tools/npm/12.2.0/18.20.8/node_modules/npm/node_modules/@npmcli/agent/node_modules/http-proxy-agent/dist/index.js from /opt/containerbase/tools/npm/12.2.0/18.20.8/node_modules/npm/node_modules/@npmcli/agent/lib/proxy.js not supported.
npm error Instead change the require of index.js in /opt/containerbase/tools/npm/12.2.0/18.20.8/node_modules/npm/node_modules/@npmcli/agent/lib/proxy.js to a dynamic import() which is available in all CommonJS modules.
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-10-01T18_05_27_579Z-debug-0.log

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: fc3b43a3-7c19-4fa5-aecc-5aa9bf875fb4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}