fastify 5.10.0 → 5.11.0

package/SPONSORS.md

@@ -18,6 +18,7 @@ or [GitHub Sponsors](https://github.com/sponsors/fastify)!
 - [Val Town](https://www.val.town/)
 - [atagon GmbH](https://github.com/atagon-GmbH)
 - [Photon](https://github.com/photon-hq)
+- [N-iX](https://www.n-ix.com/)
 
 ## Tier 2
 

package/docs/Guides/Ecosystem.md

@@ -208,8 +208,6 @@ section.
   Type-safe dependency injection support for Fastify, powered by [InferDI](https://github.com/inferdi/inferdi).
 - [`@jerome1337/fastify-enforce-routes-pattern`](https://github.com/Jerome1337/fastify-enforce-routes-pattern)
   A Fastify plugin that enforces naming pattern for routes path.
-- [`@joggr/fastify-prisma`](https://github.com/joggrdocs/fastify-prisma)
-  A plugin for accessing an instantiated PrismaClient on your server.
 - [`@matths/fastify-svelte-view`](https://github.com/matths/fastify-svelte-view)
   A Fastify plugin for rendering Svelte components with support for SSR
   (Server-Side Rendering), CSR (Client-Side Rendering), and SSR with hydration.
@@ -242,6 +240,8 @@ section.
   SeaweedFS for Fastify
 - [`@yeliex/fastify-problem-details`](https://github.com/yeliex/fastify-problem-details)
   RFC 9457 Problem Details implementation for Fastify, with typed HTTP errors.
+- [`@zrosenbauer/fastify-prisma`](https://github.com/zrosenbauer/fastify-prisma)
+  A plugin for accessing an instantiated PrismaClient on your server.
 - [`apitally`](https://github.com/apitally/apitally-js) Fastify plugin to
   integrate with [Apitally](https://apitally.io/fastify), an API analytics,
   logging and monitoring tool.

package/docs/Guides/Getting-Started.md

@@ -146,7 +146,7 @@ declaration](../Reference/Routes.md) docs).
 ```js
 // ESM
 import Fastify from 'fastify'
-import firstRoute from './our-first-route.js'
+import routes from './our-first-routes.js'
 /**
  * @type {import('fastify').FastifyInstance} Instance of Fastify
  */
@@ -154,7 +154,7 @@ const fastify = Fastify({
   logger: true
 })
 
-fastify.register(firstRoute)
+fastify.register(routes)
 
 fastify.listen({ port: 3000 }, function (err, address) {
   if (err) {
@@ -174,7 +174,7 @@ const fastify = require('fastify')({
   logger: true
 })
 
-fastify.register(require('./our-first-route'))
+fastify.register(require('./our-first-routes'))
 
 fastify.listen({ port: 3000 }, function (err, address) {
   if (err) {
@@ -187,7 +187,7 @@ fastify.listen({ port: 3000 }, function (err, address) {
 
 
 ```js
-// our-first-route.js
+// our-first-routes.js
 
 /**
  * Encapsulates the routes
@@ -236,7 +236,7 @@ npm i fastify-plugin @fastify/mongodb
 // ESM
 import Fastify from 'fastify'
 import dbConnector from './our-db-connector.js'
-import firstRoute from './our-first-route.js'
+import routes from './our-first-routes.js'
 
 /**
  * @type {import('fastify').FastifyInstance} Instance of Fastify
@@ -245,7 +245,7 @@ const fastify = Fastify({
   logger: true
 })
 fastify.register(dbConnector)
-fastify.register(firstRoute)
+fastify.register(routes)
 
 fastify.listen({ port: 3000 }, function (err, address) {
   if (err) {
@@ -266,7 +266,7 @@ const fastify = require('fastify')({
 })
 
 fastify.register(require('./our-db-connector'))
-fastify.register(require('./our-first-route'))
+fastify.register(require('./our-first-routes'))
 
 fastify.listen({ port: 3000 }, function (err, address) {
   if (err) {
@@ -325,7 +325,7 @@ module.exports = fastifyPlugin(dbConnector)
 
 ```
 
-**our-first-route.js**
+**our-first-routes.js**
 ```js
 /**
  * A plugin that provide encapsulated routes

package/docs/Reference/Errors.md

@@ -91,6 +91,8 @@
 
     - [FST_ERR_ROUTE_HANDLER_TIMEOUT_OPTION_NOT_INT](#fst_err_route_handler_timeout_option_not_int)
     - [FST_ERR_ROUTE_REWRITE_NOT_STR](#fst_err_route_rewrite_not_str)
+    - [FST_ERR_ROUTE_MISSING_CONTENT_TYPE](#fst_err_route_missing_content_type)
+    - [FST_ERR_ROUTE_MISSING_CONTENT](#fst_err_route_missing_content)
     - [FST_ERR_REOPENED_CLOSE_SERVER](#fst_err_reopened_close_server)
     - [FST_ERR_REOPENED_SERVER](#fst_err_reopened_server)
     - [FST_ERR_PLUGIN_VERSION_MISMATCH](#fst_err_plugin_version_mismatch)
@@ -369,6 +371,8 @@ Below is a table with all the error codes used by Fastify.
 | <a id="fst_err_handler_timeout">FST_ERR_HANDLER_TIMEOUT</a> | Request timed out. | Increase the `handlerTimeout` option or optimize the handler. | - |
 | <a id="fst_err_route_handler_timeout_option_not_int">FST_ERR_ROUTE_HANDLER_TIMEOUT_OPTION_NOT_INT</a> | `handlerTimeout` option must be a positive integer. | Use a positive integer for the `handlerTimeout` option. | - |
 | <a id="fst_err_route_rewrite_not_str">FST_ERR_ROUTE_REWRITE_NOT_STR</a> | `rewriteUrl` needs to be of type `string`. | Use a string for the `rewriteUrl`. | [#4554](https://github.com/fastify/fastify/pull/4554) |
+| <a id="fst_err_route_missing_content_type">FST_ERR_ROUTE_MISSING_CONTENT_TYPE</a> | `Content-Type` header is required for the request. | Send request with `Content-Type` header. | [#6832](https://github.com/fastify/fastify/pull/6832) |
+| <a id="fst_err_route_missing_content">FST_ERR_ROUTE_MISSING_CONTENT</a> | Body is required for the request. | Send request with payload. | [#6832](https://github.com/fastify/fastify/pull/6832) |
 | <a id="fst_err_reopened_close_server">FST_ERR_REOPENED_CLOSE_SERVER</a> | Fastify has already been closed and cannot be reopened. | - | [#2415](https://github.com/fastify/fastify/pull/2415) |
 | <a id="fst_err_reopened_server">FST_ERR_REOPENED_SERVER</a> | Fastify is already listening. | - | [#2415](https://github.com/fastify/fastify/pull/2415) |
 | <a id="fst_err_plugin_version_mismatch">FST_ERR_PLUGIN_VERSION_MISMATCH</a> | Installed Fastify plugin mismatched expected version. | Use a compatible version of the plugin. | [#2549](https://github.com/fastify/fastify/pull/2549) |

package/docs/Reference/Reply.md

@@ -271,7 +271,7 @@ as soon as possible.
 > in the error, you can turn on `debug` level logging.
 
 ```js
-reply.trailer('server-timing', function() {
+reply.trailer('server-timing', async function () {
   return 'db;dur=53, app;dur=47.2'
 })
 
@@ -304,7 +304,7 @@ Returns a boolean indicating if the specified trailer has been set.
 
 Remove the value of a previously set trailer.
 ```js
-reply.trailer('server-timing', function() {
+reply.trailer('server-timing', async function () {
   return 'db;dur=53, app;dur=47.2'
 })
 reply.removeTrailer('server-timing')

package/docs/Reference/Request.md

@@ -34,14 +34,14 @@ Request is a core Fastify object containing the following fields:
   value comes from `socket.encrypted` (or `X-Forwarded-Proto` when
   [`trustProxy`](./Server.md#factory-trust-proxy) is enabled).
 
-> ⚠️ Security:
-> `request.ip`, `request.ips`, `request.host`, `request.hostname`,
-> `request.port`, and `request.protocol` come from request metadata
-> (socket and/or forwarding headers) and should be treated as untrusted input.
-> Fastify does not perform security validation for business logic.
-> If these values are used in security-sensitive decisions, they must 
-> be validated explicitly (for example: trusted proxy configuration,
-> allow-lists, strict parsing, and normalization).
+> ⚠️ Security:
+> `request.ip`, `request.ips`, `request.host`, `request.hostname`,
+> `request.port`, and `request.protocol` come from request metadata
+> (socket and/or forwarding headers) and should be treated as untrusted input.
+> Fastify does not perform security validation for business logic.
+> If these values are used in security-sensitive decisions, they must 
+> be validated explicitly (for example: trusted proxy configuration,
+> allow-lists, strict parsing, and normalization).
 
 - `method` - The method of the incoming request.
 - `url` - The URL of the incoming request.
@@ -87,9 +87,9 @@ Request is a core Fastify object containing the following fields:
   default (or customized) `ValidationCompiler`. The optional `httpPart` is
   forwarded to the `ValidationCompiler` if provided, defaults to `null`.
 - [.validateInput(data, schema | httpPart, [httpPart])](#validate) -
-  Validates the input using the specified schema and returns the serialized
-  payload. If `httpPart` is provided, the function uses the serializer for
-  that HTTP Status Code. Defaults to `null`.
+  Validates the input using the specified schema or HTTP part and returns
+  `true` if the input is valid, `false` otherwise. If `httpPart` is provided,
+  the function uses the validator for that HTTP part. Defaults to `null`.
 
 ### Headers
 

package/docs/Reference/Server.md

@@ -390,8 +390,8 @@ Pino interface by having the following methods: `info`, `error`, `debug`,
 ### `disableRequestLogging`
 <a id="factory-disable-request-logging"></a>
 
-> **Deprecated:** Use the [`logController`](#log-controller) option with
-> `disableRequestLogging` or `isLogDisabled` override instead.
+> **Deprecated:** Use the [`logController`](#factory-log-controller)
+> option with `disableRequestLogging` or `isLogDisabled` override instead.
 > This top-level option will be removed in `fastify@6`.
 
 + Default: `false`
@@ -407,6 +407,8 @@ and returns a boolean. This allows for conditional request logging based on the
 request properties (e.g., URL, headers, decorations).
 
 ```js
+const { LogController } = require('fastify')
+
 // Deprecated
 const fastify = require('fastify')({
   logger: true,
@@ -418,11 +420,11 @@ const fastify = require('fastify')({
 // Recommended: use logController instead
 const fastify = require('fastify')({
   logger: true,
-  logController: {
+  logController: new LogController({
     disableRequestLogging: (request) => {
       return request.url === '/health' || request.url === '/ready'
     }
-  }
+  })
 })
 ```
 
@@ -567,7 +569,7 @@ enhance the server instance inside the `serverFactory` function before the
 ### `requestIdHeader`
 <a id="factory-request-id-header"></a>
 
-+ Default: `'request-id'`
++ Default: `false`
 
 The header name used to set the request-id. See [the
 request-id](./Logging.md#logging-request-id) section.
@@ -579,8 +581,6 @@ By default `requestIdHeader` is set to `false` and will immediately use [genReqI
 Setting `requestIdHeader` to an empty String (`""`) will set the
 requestIdHeader to `false`.
 
-+ Default: `false`
-
 ```js
 const fastify = require('fastify')({
   requestIdHeader: 'x-custom-id', // -> use 'X-Custom-Id' header if available
@@ -596,8 +596,9 @@ const fastify = require('fastify')({
 ### `requestIdLogLabel`
 <a id="factory-request-id-log-label"></a>
 
-> **Deprecated:** Use the [`logController`](#log-controller) option with
-> `requestIdLogLabel` instead. This top-level option will be removed in `fastify@6`.
+> **Deprecated:** Use the [`logController`](#factory-log-controller)
+> option with `requestIdLogLabel` instead. This top-level option will be
+> removed in `fastify@6`.
 
 + Default: `'reqId'`
 
@@ -659,11 +660,11 @@ For more examples, refer to the
 You may access the `ip`, `ips`, `host` and `protocol` values on the
 [`request`](./Request.md) object.
 
-> ⚠️ Security:
-> These values are derived from socket/forwarding metadata and must be treated
-> as untrusted input unless your proxy chain is explicitly trusted and
-> validated. Do not use them directly for authorization or other
-> security-sensitive decisions without explicit validation.
+> ⚠️ Security:
+> These values are derived from socket/forwarding metadata and must be treated
+> as untrusted input unless your proxy chain is explicitly trusted and
+> validated. Do not use them directly for authorization or other
+> security-sensitive decisions without explicit validation.
 
 ```js
 fastify.get('/', (request, reply) => {
@@ -1702,7 +1703,7 @@ Fake HTTP injection (for testing purposes)
 <a id="addHttpMethod"></a>
 
 Fastify supports the `GET`, `HEAD`, `TRACE`, `DELETE`, `OPTIONS`,
-`PATCH`, `PUT` and `POST` HTTP methods by default.
+`PATCH`, `PUT`, `POST` and `QUERY` HTTP methods by default.
 The `addHttpMethod` method allows to add any non standard HTTP
 methods to the server that are [supported by Node.js](https://nodejs.org/api/http.html#httpmethods).
 

package/docs/Reference/TypeScript.md

@@ -15,7 +15,7 @@ fill in the gaps. Just make sure to read our
 [`CONTRIBUTING.md`](https://github.com/fastify/fastify/blob/main/CONTRIBUTING.md)
 file before getting started to make sure things go smoothly!
 
-> The documentation in this section covers Fastify version 3.x typings
+> The documentation in this section covers Fastify typings
 
 > Plugins may or may not include typings. See [Plugins](#plugins) for more
 > information. We encourage users to send pull requests to improve typings
@@ -90,7 +90,7 @@ in a blank http Fastify server.
    🏓
 
 🎉 You now have a working Typescript Fastify server! This example demonstrates
-the simplicity of the version 3.x type system. By default, the type system
+the simplicity of the type system. By default, the type system
 assumes you are using an `http` server. The later examples will demonstrate how
 to create more complex servers such as `https` and `http2`, how to specify route
 schemas, and more!
@@ -545,9 +545,9 @@ Fastify Plugin in a TypeScript Project.
    }
 
    // export plugin using fastify-plugin
-   export default fp(myPluginCallback, '3.x')
+   export default fp(myPluginCallback)
    // or
-   // export default fp(myPluginAsync, '3.x')
+   // export default fp(myPluginAsync)
    ```
 6. Run `npm run build` to compile the plugin code and produce both a JavaScript
    source file and a type definition file.
@@ -595,7 +595,6 @@ your plugin.
    }
 
    module.exports = fp(myPlugin, {
-     fastify: '5.x',
      name: 'my-plugin' // this is used by fastify-plugin to derive the property name
    })
    ```
@@ -843,8 +842,7 @@ module.exports = async function (fastify, { optionA, optionB }) {
 
 ## API Type System Documentation
 
-This section is a detailed account of all the types available to you in Fastify
-version 3.x
+This section is a detailed account of all the types available to you in Fastify.
 
 All `http`, `https`, and `http2` types are inferred from `@types/node`
 

package/docs/Reference/Warnings.md

@@ -33,6 +33,7 @@ one of the following methods:
 - Set the `NODE_NO_WARNINGS` environment variable to `1`
 - Pass the `--no-warnings` flag to the node process
 - Set `no-warnings` in the `NODE_OPTIONS` environment variable
+- Pass `--disable-warning=FSTWRN004` to disable a specific warning
 
 For more information on disabling warnings, see [Node's documentation](https://nodejs.org/api/cli.html).
 

package/eslint.config.js

@@ -28,7 +28,7 @@ module.exports = [
   {
     files: ['**/*.d.ts'],
     rules: {
-      'max-len': 'off'
+      '@stylistic/indent-binary-ops': ['error', 2]
     }
   },
   {

package/fastify.d.ts

@@ -78,7 +78,9 @@ declare namespace fastify {
     http?: http.ServerOptions | null
   }
 
-  type FindMyWayVersion<RawServer extends RawServerBase> = RawServer extends http.Server ? HTTPVersion.V1 : HTTPVersion.V2
+  type FindMyWayVersion<RawServer extends RawServerBase> = RawServer extends http.Server
+    ? HTTPVersion.V1
+    : HTTPVersion.V2
   type FindMyWayConfigForServer<RawServer extends RawServerBase> = FindMyWayConfig<FindMyWayVersion<RawServer>>
 
   export interface ConnectionError extends Error {
@@ -163,15 +165,39 @@ declare namespace fastify {
     };
     return503OnClosing?: boolean,
     ajv?: Parameters<BuildCompilerFromPool>[1],
-    frameworkErrors?: <RequestGeneric extends RequestGenericInterface = RequestGenericInterface, TypeProvider extends FastifyTypeProvider = FastifyTypeProviderDefault, SchemaCompiler extends FastifySchema = FastifySchema>(
+    frameworkErrors?: <
+      RequestGeneric extends RequestGenericInterface = RequestGenericInterface,
+      TypeProvider extends FastifyTypeProvider = FastifyTypeProviderDefault,
+      SchemaCompiler extends FastifySchema = FastifySchema
+    >(
       error: FastifyError,
-      req: FastifyRequest<RequestGeneric, RawServer, RawRequestDefaultExpression<RawServer>, FastifySchema, TypeProvider>,
-      res: FastifyReply<RequestGeneric, RawServer, RawRequestDefaultExpression<RawServer>, RawReplyDefaultExpression<RawServer>, FastifyContextConfig, SchemaCompiler, TypeProvider>
+      req: FastifyRequest<
+        RequestGeneric,
+        RawServer,
+        RawRequestDefaultExpression<RawServer>,
+        FastifySchema,
+        TypeProvider
+      >,
+      res: FastifyReply<
+        RequestGeneric,
+        RawServer,
+        RawRequestDefaultExpression<RawServer>,
+        RawReplyDefaultExpression<RawServer>,
+        FastifyContextConfig,
+        SchemaCompiler,
+        TypeProvider
+      >
     ) => void,
     rewriteUrl?: (
       // The RawRequestDefaultExpression, RawReplyDefaultExpression, and FastifyTypeProviderDefault parameters
       // should be narrowed further but those generic parameters are not passed to this FastifyServerOptions type
-      this: FastifyInstance<RawServer, RawRequestDefaultExpression<RawServer>, RawReplyDefaultExpression<RawServer>, Logger, FastifyTypeProviderDefault>,
+      this: FastifyInstance<
+        RawServer,
+        RawRequestDefaultExpression<RawServer>,
+        RawReplyDefaultExpression<RawServer>,
+        Logger,
+        FastifyTypeProviderDefault
+      >,
       req: RawRequestDefaultExpression<RawServer>
     ) => string,
     schemaErrorFormatter?: SchemaErrorFormatter,
@@ -198,13 +224,25 @@ declare namespace fastify {
     FastifyListenOptions, FastifyInstance, PrintRoutesOptions, // './types/instance'
     FastifyLoggerOptions, FastifyBaseLogger, FastifyLoggerInstance, FastifyLogFn, LogLevel, // './types/logger'
     FastifyRequestContext, FastifyContextConfig, FastifyReplyContext, // './types/context'
-    RouteHandler, RouteHandlerMethod, RouteOptions, RouteShorthandMethod, RouteShorthandOptions, RouteShorthandOptionsWithHandler, RouteGenericInterface, // './types/route'
+    RouteHandler, RouteHandlerMethod, RouteOptions, RouteShorthandMethod, RouteShorthandOptions,
+    RouteShorthandOptionsWithHandler, RouteGenericInterface, // './types/route'
     FastifyRegister, FastifyRegisterOptions, RegisterOptions, // './types/register'
-    FastifyBodyParser, FastifyContentTypeParser, AddContentTypeParser, hasContentTypeParser, getDefaultJsonParser, ProtoAction, ConstructorAction, // './types/content-type-parser'
+    FastifyBodyParser, FastifyContentTypeParser, AddContentTypeParser, hasContentTypeParser, getDefaultJsonParser,
+    ProtoAction, ConstructorAction, // './types/content-type-parser'
     FastifyError, // '@fastify/error'
     FastifySchema, FastifySchemaValidationError, FastifySchemaCompiler, FastifySerializerCompiler, // './types/schema'
-    HTTPMethods, RawServerBase, RawRequestDefaultExpression, RawReplyDefaultExpression, RawServerDefault, ContextConfigDefault, RequestBodyDefault, RequestQuerystringDefault, RequestParamsDefault, RequestHeadersDefault, // './types/utils'
-    DoneFuncWithErrOrRes, HookHandlerDoneFunction, RequestPayload, onCloseAsyncHookHandler, onCloseHookHandler, onErrorAsyncHookHandler, onErrorHookHandler, onReadyAsyncHookHandler, onReadyHookHandler, onListenAsyncHookHandler, onListenHookHandler, onRegisterHookHandler, onRequestAsyncHookHandler, onRequestHookHandler, onResponseAsyncHookHandler, onResponseHookHandler, onRouteHookHandler, onSendAsyncHookHandler, onSendHookHandler, onTimeoutAsyncHookHandler, onTimeoutHookHandler, preHandlerAsyncHookHandler, preHandlerHookHandler, preParsingAsyncHookHandler, preParsingHookHandler, preSerializationAsyncHookHandler, preSerializationHookHandler, preValidationAsyncHookHandler, preValidationHookHandler, onRequestAbortHookHandler, onRequestAbortAsyncHookHandler, preCloseAsyncHookHandler, preCloseHookHandler, // './types/hooks'
+    HTTPMethods, RawServerBase, RawRequestDefaultExpression, RawReplyDefaultExpression, RawServerDefault,
+    ContextConfigDefault, RequestBodyDefault, RequestQuerystringDefault, RequestParamsDefault, RequestHeadersDefault,
+    // './types/utils'
+    DoneFuncWithErrOrRes, HookHandlerDoneFunction, RequestPayload, onCloseAsyncHookHandler, onCloseHookHandler,
+    onErrorAsyncHookHandler, onErrorHookHandler, onReadyAsyncHookHandler, onReadyHookHandler,
+    onListenAsyncHookHandler, onListenHookHandler, onRegisterHookHandler, onRequestAsyncHookHandler,
+    onRequestHookHandler, onResponseAsyncHookHandler, onResponseHookHandler, onRouteHookHandler,
+    onSendAsyncHookHandler, onSendHookHandler, onTimeoutAsyncHookHandler, onTimeoutHookHandler,
+    preHandlerAsyncHookHandler, preHandlerHookHandler, preParsingAsyncHookHandler, preParsingHookHandler,
+    preSerializationAsyncHookHandler, preSerializationHookHandler, preValidationAsyncHookHandler,
+    preValidationHookHandler, onRequestAbortHookHandler, onRequestAbortAsyncHookHandler, preCloseAsyncHookHandler,
+    preCloseHookHandler, // './types/hooks'
     FastifyServerFactory, FastifyServerFactoryHandler, // './types/serverFactory'
     FastifyTypeProvider, FastifyTypeProviderDefault, SafePromiseLike, // './types/type-provider'
     FastifyErrorCodes // './types/errors'
@@ -232,7 +270,8 @@ declare function fastify<
   Reply extends RawReplyDefaultExpression<Server> = RawReplyDefaultExpression<Server>,
   Logger extends FastifyBaseLogger = FastifyBaseLogger,
   TypeProvider extends FastifyTypeProvider = FastifyTypeProviderDefault
-> (opts: fastify.FastifyHttp2SecureOptions<Server, Logger>): FastifyInstance<Server, Request, Reply, Logger, TypeProvider> & SafePromiseLike<FastifyInstance<Server, Request, Reply, Logger, TypeProvider>>
+> (opts: fastify.FastifyHttp2SecureOptions<Server, Logger>): FastifyInstance<Server, Request, Reply, Logger,
+  TypeProvider> & SafePromiseLike<FastifyInstance<Server, Request, Reply, Logger, TypeProvider>>
 
 declare function fastify<
   Server extends http2.Http2Server,
@@ -240,7 +279,8 @@ declare function fastify<
   Reply extends RawReplyDefaultExpression<Server> = RawReplyDefaultExpression<Server>,
   Logger extends FastifyBaseLogger = FastifyBaseLogger,
   TypeProvider extends FastifyTypeProvider = FastifyTypeProviderDefault
-> (opts: fastify.FastifyHttp2Options<Server, Logger>): FastifyInstance<Server, Request, Reply, Logger, TypeProvider> & SafePromiseLike<FastifyInstance<Server, Request, Reply, Logger, TypeProvider>>
+> (opts: fastify.FastifyHttp2Options<Server, Logger>): FastifyInstance<Server, Request, Reply, Logger,
+  TypeProvider> & SafePromiseLike<FastifyInstance<Server, Request, Reply, Logger, TypeProvider>>
 
 declare function fastify<
   Server extends https.Server,
@@ -248,7 +288,8 @@ declare function fastify<
   Reply extends RawReplyDefaultExpression<Server> = RawReplyDefaultExpression<Server>,
   Logger extends FastifyBaseLogger = FastifyBaseLogger,
   TypeProvider extends FastifyTypeProvider = FastifyTypeProviderDefault
-> (opts: fastify.FastifyHttpsOptions<Server, Logger>): FastifyInstance<Server, Request, Reply, Logger, TypeProvider> & SafePromiseLike<FastifyInstance<Server, Request, Reply, Logger, TypeProvider>>
+> (opts: fastify.FastifyHttpsOptions<Server, Logger>): FastifyInstance<Server, Request, Reply, Logger,
+  TypeProvider> & SafePromiseLike<FastifyInstance<Server, Request, Reply, Logger, TypeProvider>>
 
 declare function fastify<
   Server extends http.Server,
@@ -256,7 +297,8 @@ declare function fastify<
   Reply extends RawReplyDefaultExpression<Server> = RawReplyDefaultExpression<Server>,
   Logger extends FastifyBaseLogger = FastifyBaseLogger,
   TypeProvider extends FastifyTypeProvider = FastifyTypeProviderDefault
-> (opts?: fastify.FastifyHttpOptions<Server, Logger>): FastifyInstance<Server, Request, Reply, Logger, TypeProvider> & SafePromiseLike<FastifyInstance<Server, Request, Reply, Logger, TypeProvider>>
+> (opts?: fastify.FastifyHttpOptions<Server, Logger>): FastifyInstance<Server, Request, Reply, Logger,
+  TypeProvider> & SafePromiseLike<FastifyInstance<Server, Request, Reply, Logger, TypeProvider>>
 
 // CJS export
 // const fastify = require('fastify')

package/fastify.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const VERSION = '5.10.0'
+const VERSION = '5.11.0'
 
 const Avvio = require('avvio')
 const http = require('node:http')
@@ -143,7 +143,9 @@ function fastify (serverOptions) {
         'OPTIONS',
         'PATCH',
         'PUT',
-        'POST'
+        'POST',
+        // RFC 10008
+        'QUERY'
       ])
     },
     [kOptions]: options,
@@ -200,6 +202,9 @@ function fastify (serverOptions) {
     options: function _options (url, options, handler) {
       return router.prepareRoute.call(this, { method: 'OPTIONS', url, options, handler })
     },
+    query: function _query (url, options, handler) {
+      return router.prepareRoute.call(this, { method: 'QUERY', url, options, handler })
+    },
     all: function _all (url, options, handler) {
       return router.prepareRoute.call(this, { method: this.supportedMethods, url, options, handler })
     },

package/lib/content-type.js

@@ -3,15 +3,37 @@
 const { LruMap: Lru } = require('toad-cache')
 
 /**
- * keyValuePairsReg is used to split the parameters list into associated
- * key value pairings. The leading `(?:^|;)\s*` anchor ensures the regex
- * only attempts matches at parameter boundaries, preventing quadratic
- * backtracking on malformed input.
+ * keyValuePairsReg matches a single `parameter-name "=" parameter-value`
+ * at a parameter boundary, following RFC 9110 §5.6.6 grammar:
+ *
+ *   parameter       = parameter-name "=" parameter-value
+ *   parameter-name  = token
+ *   parameter-value = ( token / quoted-string )
+ *   quoted-string   = DQUOTE *( qdtext / quoted-pair ) DQUOTE
+ *   qdtext          = HTAB / SP / %x21 / %x23-5B / %x5D-7E / obs-text
+ *   quoted-pair     = "\" ( HTAB / SP / VCHAR / obs-text )
+ *   obs-text        = %x80-FF
+ *
+ * The value alternative accepts either a bare token or a full quoted-string
+ * whose content matches the qdtext / quoted-pair character ranges. Because
+ * the quoted-string branch is aware of `\"` as an escape, embedded `"` and
+ * `;` characters inside a quoted value do not terminate the value.
  *
  * @see https://httpwg.org/specs/rfc9110.html#parameter
  * @type {RegExp}
  */
-const keyValuePairsReg = /(?:^|;)\s*([\w!#$%&'*+.^`|~-]+)=([^;]*)/gm
+const keyValuePairsReg = /(?:^|;)\s*([\w!#$%&'*+.^`|~-]+)=("(?:[\t\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\t\u0020-\u00ff])*"|[\w!#$%&'*+.^`|~-]+)/gu
+
+/**
+ * quotedPairReg matches a quoted-pair (a backslash followed by a single
+ * quoted-pair-allowed octet) inside a quoted-string value. Per RFC 9110
+ * §5.6.4, recipients that process the value of a quoted-string MUST handle
+ * a quoted-pair as if it were replaced by the octet following the backslash.
+ *
+ * @see https://httpwg.org/specs/rfc9110.html#quoted.string
+ * @type {RegExp}
+ */
+const quotedPairReg = /\\([\t\u0020-\u00ff])/gu
 
 /**
  * typeNameReg is used to validate that the first part of the media-type
@@ -140,21 +162,17 @@ class ContentType {
       const key = matches[1].toLowerCase()
       // Parameter values might or might not be case-sensitive,
       // depending on the semantics of the parameter name.
-      const value = matches[2]
-      if (value[0] === '"') {
-        if (value.at(-1) !== '"') {
-          this.#parameters.set(key, 'invalid quoted string')
-          matches = keyValuePairsReg.exec(paramsList)
-          continue
+      let value = matches[2]
+      if (value.charCodeAt(0) === 0x22 /* " */) {
+        // Strip the surrounding DQUOTEs and unescape quoted-pairs per
+        // RFC 9110 §5.6.4. The regex guarantees the value starts and ends
+        // with `"` and only contains permitted qdtext / quoted-pair octets.
+        value = value.slice(1, -1)
+        if (value.indexOf('\\') !== -1) {
+          value = value.replace(quotedPairReg, '$1')
         }
-        // We should probably verify the value matches a quoted string
-        // (https://httpwg.org/specs/rfc9110.html#rule.quoted-string) value.
-        // But we are not really doing much with the parameter values, so we
-        // are omitting that at this time.
-        this.#parameters.set(key, value.slice(1, value.length - 1))
-      } else {
-        this.#parameters.set(key, value)
       }
+      this.#parameters.set(key, value)
       matches = keyValuePairsReg.exec(paramsList)
     }
   }

package/lib/errors.js

@@ -455,6 +455,16 @@ const codes = {
     500,
     TypeError
   ),
+  FST_ERR_ROUTE_MISSING_CONTENT_TYPE: createError(
+    'FST_ERR_ROUTE_MISSING_CONTENT_TYPE',
+    "Method '%s' must provide a 'Content-Type' header.",
+    400
+  ),
+  FST_ERR_ROUTE_MISSING_CONTENT: createError(
+    'FST_ERR_ROUTE_MISSING_CONTENT',
+    "Method '%s' must provide a request body.",
+    400
+  ),
 
   /**
    *  again listen when close server

package/lib/handle-request.js

@@ -4,7 +4,11 @@ const diagnostics = require('node:diagnostics_channel')
 const wrapThenable = require('./wrap-thenable')
 const { validate: validateSchema } = require('./validation')
 const { preValidationHookRunner, preHandlerHookRunner } = require('./hooks')
-const { FST_ERR_CTP_INVALID_MEDIA_TYPE } = require('./errors')
+const {
+  FST_ERR_CTP_INVALID_MEDIA_TYPE,
+  FST_ERR_ROUTE_MISSING_CONTENT_TYPE,
+  FST_ERR_ROUTE_MISSING_CONTENT
+} = require('./errors')
 const { setErrorStatusCode } = require('./error-status')
 const {
   kReplyIsError,
@@ -37,13 +41,30 @@ function handleRequest (err, request, reply) {
     const headers = request.headers
     const ctHeader = headers['content-type']
 
-    if (ctHeader === undefined) {
-      const contentLength = headers['content-length']
-      const transferEncoding = headers['transfer-encoding']
-      const isEmptyBody = transferEncoding === undefined &&
-        (contentLength === undefined || contentLength === '0')
+    if (method === 'QUERY') {
+      if (ctHeader === undefined) {
+        // https://datatracker.ietf.org/doc/html/rfc10008#section-2
+        // Servers MUST fail the request if the Content-Type request field
+        // ([HTTP], Section 8.3) is missing or is inconsistent with the
+        // request content.
+        reply[kReplyIsError] = true
+        reply.status(400).send(new FST_ERR_ROUTE_MISSING_CONTENT_TYPE(method))
+        return
+      }
 
-      if (isEmptyBody) {
+      if (isEmptyBody(headers)) {
+        // https://datatracker.ietf.org/doc/html/rfc10008#section-2
+        // Servers MUST fail the request if the Content-Type request field
+        // ([HTTP], Section 8.3) is missing or is inconsistent with the
+        // request content.
+        reply[kReplyIsError] = true
+        reply.status(400).send(new FST_ERR_ROUTE_MISSING_CONTENT(method))
+        return
+      }
+    }
+
+    if (ctHeader === undefined) {
+      if (isEmptyBody(headers)) {
         // Request has no body to parse
         handler(request, reply)
         return
@@ -88,6 +109,13 @@ function handler (request, reply) {
   }
 }
 
+function isEmptyBody (headers) {
+  const contentLength = headers['content-length']
+  const transferEncoding = headers['transfer-encoding']
+  return transferEncoding === undefined &&
+    (contentLength === undefined || contentLength === '0')
+}
+
 function preValidationCallback (err, request, reply) {
   if (reply.sent === true) return
 

package/lib/hooks.js

@@ -306,7 +306,11 @@ function onSendHookRunner (functions, request, reply, payload, cb) {
   }
 
   function handleResolve (newPayload) {
-    next(null, newPayload)
+    try {
+      next(null, newPayload)
+    } catch (err) {
+      cb(err, request, reply, payload)
+    }
   }
 
   function handleReject (err) {