fastify@5.9.0
Skip this version — install 5.12.7 instead.
7 known advisories (worst: high), fixed in 5.12.5.
Why this verdict
- 7 known advisories (worst: high), fixed in 5.12.5.Evidence
Confidence 100% · algorithm v1 · computed 2026-10-19. How verdicts work
Supply chain and security
- Malware reports
- None known (OSV)
- Known advisories
- 7 known
- License
- MIT
- Install scripts
- None
- Build provenance
- No provenance
- Weekly downloads
- 77,276
- GHSA-3m5p-2c4r-xxw2fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
- GHSA-4mh8-r7rc-xpvcfastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
- GHSA-667r-xxjv-c9mmfastify vulnerable to request body replacement via an async validation result collision
- GHSA-9q9j-q6p8-xq58fastify vulnerable to header validation bypass via incomplete schema case normalization
- GHSA-hwr6-493r-vm6hfastify vulnerable to request validation bypass via skipped boolean false schemas
- GHSA-p68q-wchp-6fh7fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
- GHSA-w2qp-rph6-63g4fastify vulnerable to schema validation bypass via root primitive coercion mismatch
Compatibility
No compatibility boundary is crossed: this is a patch or minor release on a stable major.
0 issues mention this version in fastify/fastify within 14 days of release. See them on GitHub
Check the official release notes below for behaviour changes before merging.
Release notes
Read the Fastify changelog on Changes.Watch or the package page on npm for this version’s features and fixes.
Deprecations and deadlines
The maintainer has not deprecated this version on npm.