fastify 5.11.2 → 5.12.0

package/README.md

@@ -73,7 +73,7 @@ mkdir my-app
 cd my-app
 ```
 
-Generate a fastify project with `npm init`:
+Generate a Fastify project with `npm init`:
 
 ```sh
 npm init fastify
@@ -121,7 +121,7 @@ import Fastify from 'fastify'
 const fastify = Fastify({
   logger: true
 })
-// CommonJs
+// CommonJS
 const fastify = require('fastify')({
   logger: true
 })
@@ -147,7 +147,7 @@ import Fastify from 'fastify'
 const fastify = Fastify({
   logger: true
 })
-// CommonJs
+// CommonJS
 const fastify = require('fastify')({
   logger: true
 })
@@ -181,7 +181,7 @@ If you learn best by reading code, explore the official [demo](https://github.co
 ### Core features
 
 - **Highly performant:** as far as we know, Fastify is one of the fastest web
-  frameworks in town, depending on the code complexity we can serve up to 76+
+  frameworks in town, depending on the code complexity we can serve more than 76
   thousand requests per second.
 - **Extensible:** Fastify is fully extensible via its hooks, plugins, and
   decorators.
@@ -189,7 +189,7 @@ If you learn best by reading code, explore the official [demo](https://github.co
   Schema](https://json-schema.org/) to validate your routes and serialize your
   outputs. Internally Fastify compiles the schema in a highly performant
   function.
-- **Logging:** logs are extremely important but are costly; we chose the best
+- **Logging:** logs are extremely important, but are costly; we chose the best
   logger to almost remove this cost, [Pino](https://github.com/pinojs/pino)!
 - **Developer friendly:** the framework is built to be very expressive and help
   developers in their daily use without sacrificing performance and
@@ -212,8 +212,8 @@ second average
 | -                  |                            |              |               |
 | `http.Server`      | 16.14.2	                  | ✗     | 74,513        |
 
-These benchmarks taken using https://github.com/fastify/benchmarks. This is a
-synthetic "hello world" benchmark that aims to evaluate the framework overhead.
+These benchmarks were taken using https://github.com/fastify/benchmarks. This is
+a synthetic "hello world" benchmark that aims to evaluate the framework overhead.
 The overhead that each framework has on your application depends on your
 application. You should __always__ benchmark if performance matters to you.
 

package/SPONSORS.md

@@ -19,6 +19,7 @@ or [GitHub Sponsors](https://github.com/sponsors/fastify)!
 - [atagon GmbH](https://github.com/atagon-GmbH)
 - [Photon](https://github.com/photon-hq)
 - [N-iX](https://www.n-ix.com/)
+- [TestMu AI](https://www.testmuai.com/?utm_medium=sponsor&utm_source=fastify)
 
 ## Tier 2
 

package/docs/Guides/Serverless.md

@@ -256,9 +256,41 @@ curl -X POST https://$GOOGLE_REGION-$GOOGLE_PROJECT.cloudfunctions.net/me \
 {"message":"Hello Fastify!"}
 ```
 
+#### Per-route logging
+
+Google Cloud Functions exposes one entry point for your Fastify instance, so
+the dashboard may show all HTTP traffic under that function. Instead of
+deploying one function per endpoint, keep the single Fastify instance and emit
+a structured log line after each request with the matched route:
+
+```js
+fastify.addHook('onResponse', async (request, reply) => {
+  request.log.info({
+    route: request.routeOptions.url,
+    method: request.method,
+    statusCode: reply.statusCode,
+    responseTime: reply.elapsedTime
+  }, 'request completed')
+})
+```
+
+`request.routeOptions.url` is the route pattern, so `/users/123` and
+`/users/456` are grouped under `/users/:id`. With Fastify's logger enabled, the
+fields are emitted as structured log fields, as described in the [Cloud
+Logging structured logging documentation](https://cloud.google.com/logging/docs/structured-logging)
+and the [Cloud Functions logging guide](https://cloud.google.com/functions/docs/monitoring/logging).
+In Cloud Logging, create a [log-based
+metric](https://cloud.google.com/logging/docs/logs-based-metrics) or filter on
+`jsonPayload.route` to get per-route request counts, latency, and error rates.
+
+The same hook works when deploying through Firebase Functions with `onRequest`.
+
 ### References
 - [Google Cloud Functions - Node.js Quickstart
-  ](https://docs.cloud.google.com/run/docs/quickstarts/functions/deploy-functions-gcloud)
+  ](https://cloud.google.com/run/docs/quickstarts/functions/deploy-functions-gcloud)
+- [Cloud Logging - Structured Logging](https://cloud.google.com/logging/docs/structured-logging)
+- [Cloud Logging - Log-based Metrics](https://cloud.google.com/logging/docs/logs-based-metrics)
+- [Cloud Functions - Logging](https://cloud.google.com/functions/docs/monitoring/logging)
 
 ## Google Firebase Functions
 
@@ -594,4 +626,4 @@ https://vercel.com/templates/backend/fastify-on-vercel).
 [Fluid compute](https://vercel.com/docs/fluid-compute) currently
 requires an explicit opt-in. Learn more about enabling Fluid compute
 [here](
-https://vercel.com/docs/fluid-compute#enabling-fluid-compute).
+https://vercel.com/docs/fluid-compute#enabling-fluid-compute).

package/docs/Reference/Encapsulation.md

@@ -140,7 +140,7 @@ update the code as follows:
 'use strict'
 
 const fastify = require('fastify')()
-const fastifyPlugin = require('fastify-plugin')
+const fp = require('fastify-plugin')
 
 fastify.decorateRequest('answer', 42)
 
@@ -161,7 +161,7 @@ fastify.register(async function publicContext (childServer) {
     }
   })
 
-  childServer.register(fastifyPlugin(grandchildContext))
+  childServer.register(fp(grandchildContext))
 
   async function grandchildContext (grandchildServer) {
     grandchildServer.decorateRequest('bar', 'bar')
@@ -192,4 +192,33 @@ curl http://127.0.0.1:8000/three
 # {"answer":42,"foo":"foo","bar":"bar"}
 ```
 
+`fastify-plugin` breaks encapsulation only for the plugin it wraps. Plugins
+registered inside it without `fastify-plugin` still create new encapsulated
+contexts:
+
+```js
+'use strict'
+
+const fastify = require('fastify')()
+const fp = require('fastify-plugin')
+
+fastify.register(fp(async function sharedContext (childServer) {
+  childServer.decorate('foo', 'foo')
+
+  childServer.register(async function encapsulatedContext (grandchildServer) {
+    grandchildServer.decorate('bar', 'bar')
+  })
+}))
+
+await fastify.ready()
+
+console.log(fastify.foo) // 'foo'
+console.log(fastify.bar) // undefined
+```
+
+The `foo` decorator is available in the root context because it is added
+directly by the plugin wrapped with `fastify-plugin`. The nested `register`
+call still creates a grandchild context, so the `bar` decorator remains
+available only in that context and its children.
+
 [fastify-plugin]: https://github.com/fastify/fastify-plugin

package/docs/Reference/Errors.md

@@ -11,6 +11,7 @@
   - [Errors In Fastify](#errors-in-fastify)
     - [Errors In Input Data](#errors-in-input-data)
     - [Catching Uncaught Errors In Fastify](#catching-uncaught-errors-in-fastify)
+    - [What The Default Error Handler Sends](#what-the-default-error-handler-sends)
   - [Errors In Fastify Lifecycle Hooks And A Custom Error Handler](#errors-in-fastify-lifecycle-hooks-and-a-custom-error-handler)
   - [Fastify Error Codes](#fastify-error-codes)
     - [FST_ERR_NOT_FOUND](#fst_err_not_found)
@@ -142,10 +143,82 @@ performance. This includes:
    })`
 
 In both cases, the error will be caught safely and routed to Fastify's default
-error handler, resulting in a generic `500 Internal Server Error` response.
+error handler, resulting in a `500 Internal Server Error` response.
 
-To customize this behavior, use
-[`setErrorHandler`](./Server.md#seterrorhandler).
+#### What The Default Error Handler Sends
+The default error handler serializes the error into a JSON body with the
+`statusCode`, `error`, and `message` properties, plus `code` when the error
+carries one:
+
+```js
+app.get('/', async () => { throw new Error('kaboom') })
+```
+
+```json
+{
+  "statusCode": 500,
+  "error": "Internal Server Error",
+  "message": "kaboom"
+}
+```
+
+The `error` property is the generic HTTP status text, but **`message` is
+`error.message` verbatim**. This applies to every status code, including `500`.
+Fastify's built-in error serializer emits only these four properties, so the
+stack trace is not part of the default payload — but a route-level response
+schema replaces that serializer, and one that declares a `stack` property will
+serialize it.
+
+> Security:
+> Because `message` and `code` are forwarded as-is, errors thrown by libraries
+> deeper in your application are exposed to the client. A database driver
+> error, for example, can leak schema details and query text:
+>
+> ```json
+> {
+>   "statusCode": 500,
+>   "code": "ER_BAD_FIELD_ERROR",
+>   "error": "Internal Server Error",
+>   "message": "Unknown column 'username' in 'field list'"
+> }
+> ```
+>
+> Fastify does not distinguish between development and production here. If
+> unexpected errors must not reach the client, handle this explicitly.
+
+Register a [`setErrorHandler`](./Server.md#seterrorhandler) to replace the
+message for errors you did not raise deliberately, while letting the ones you
+did pass through:
+
+```js
+app.setErrorHandler(function (error, request, reply) {
+  // Errors with a statusCode below 500 were raised deliberately by this
+  // application, as were validation errors. A status code below 500 is not on
+  // its own a guarantee that the message is safe to expose — narrow this
+  // condition if any of yours are not.
+  if (error.validation || (error.statusCode && error.statusCode < 500)) {
+    return reply.send(error)
+  }
+
+  // Anything else is unexpected: log it, but do not describe it to the client.
+  this.log.error({ err: error }, 'unhandled error')
+  reply.status(500).send({
+    statusCode: 500,
+    error: 'Internal Server Error',
+    message: 'Internal Server Error'
+  })
+})
+```
+
+The handler above is registered on the root instance, so it applies to every
+route. Error handlers are encapsulated; for how they resolve across plugin
+contexts, see
+[the next section](#errors-in-fastify-lifecycle-hooks-and-a-custom-error-handler).
+
+Note that a route-level response schema is still applied to whatever the error
+handler sends, and will reshape the payload accordingly — including properties
+the built-in error serializer would have omitted, such as `stack`. See
+[Serialization](./Validation-and-Serialization.md#serialization).
 
 ### Errors In Fastify Lifecycle Hooks And A Custom Error Handler
 

package/docs/Reference/Reply.md

@@ -6,6 +6,7 @@
   - [.code(statusCode)](#codestatuscode)
   - [.elapsedTime](#elapsedtime)
   - [.statusCode](#statuscode)
+  - [.mediaType](#mediatype)
   - [.server](#server)
   - [.header(key, value)](#headerkey-value)
   - [.headers(object)](#headersobject)
@@ -51,6 +52,7 @@ object that exposes the following functions and properties:
 - `.statusCode` - Read and set the HTTP status code.
 - `.elapsedTime` - Returns the amount of time passed
 since the request was received by Fastify.
+- `.mediaType` - The media type extracted from `Content-Type` header.
 - `.server` - A reference to the fastify instance object.
 - `.header(name, value)` - Sets a response header.
 - `.headers(object)` - Sets all the keys of the object as response headers.
@@ -129,6 +131,18 @@ if (reply.statusCode >= 299) {
   reply.statusCode = 500
 }
 ```
+### .mediaType
+<a id="mediatype"></a>
+
+Returns the media type extracted from `Content-Type` header. When `Content-Type`
+header is missing, it will return `undefined`.
+
+```js
+if (reply.mediaType === 'image/gif') {
+  const versionBuffer = new Uint8Array(reply.payload, 3, 3)
+  reply.header('x-gif-version', new TextDecoder().decode(versionBuffer))
+}
+```
 
 ### .server
 <a id="server"></a>

package/docs/Reference/Request.md

@@ -9,7 +9,11 @@ Request is a core Fastify object containing the following fields:
 - `body` - The request payload, see [Content-Type Parser](./ContentTypeParser.md)
   for details on what request payloads Fastify natively parses and how to support
   other content types.
-- `params` - The params matching the URL.
+- `params` - The params matching the URL. Values are percent-decoded
+  (for example `%20` becomes a space, and `%2f` becomes `/`). Decoded
+  values may contain `.`, `..`, `/`, or other characters; treat them as
+  untrusted input. See the security note below and
+  [Routes - Url building](./Routes.md#url-building).
 - [`headers`](#headers) - The headers getter and setter.
 - `raw` - The incoming HTTP request from Node core.
 - `server` - The Fastify server instance, scoped to the current
@@ -35,13 +39,21 @@ Request is a core Fastify object containing the following fields:
   [`trustProxy`](./Server.md#factory-trust-proxy) is enabled).
 
 > ⚠️ Security:
+> `request.params`, `request.query`, `request.headers`, and `request.body`
+> are untrusted network input. Route parameter values are percent-decoded
+> before your handler runs, so a segment like `..%2ffile` becomes `../file`
+> in `request.params`. Do not use parameter values as filesystem paths,
+> template names, or redirect targets without validating or containing
+> them. Prefer [`@fastify/static`](https://github.com/fastify/fastify-static)
+> (or `reply.sendFile`) when serving files from a root directory.
+>
 > `request.ip`, `request.ips`, `request.host`, `request.hostname`,
 > `request.port`, and `request.protocol` come from request metadata
-> (socket and/or forwarding headers) and should be treated as untrusted input.
-> Fastify does not perform security validation for business logic.
-> If these values are used in security-sensitive decisions, they must 
-> be validated explicitly (for example: trusted proxy configuration,
-> allow-lists, strict parsing, and normalization).
+> (socket and/or forwarding headers) and should also be treated as
+> untrusted input. Fastify does not perform security validation for
+> business logic. If these values are used in security-sensitive decisions,
+> they must be validated explicitly (for example: trusted proxy
+> configuration, allow-lists, strict parsing, and normalization).
 
 - `method` - The method of the incoming request.
 - `url` - The URL of the incoming request.

package/docs/Reference/Routes.md

@@ -328,6 +328,19 @@ Prefer a single parameter approach, especially on routes that are on the hot
 path of your application. For more details, see
 [find-my-way](https://github.com/delvedor/find-my-way).
 
+> ⚠️ Security:
+> Fastify (via find-my-way) percent-decodes route parameters and wildcards
+> before they reach your handler. Encoded separators in a segment are
+> decoded in the parameter value: for a route `/download/:file`, a request
+> to `/download/..%2fsecret.txt` yields
+> `request.params.file === '../secret.txt'`. Parameters are untrusted
+> input. Do not pass them to `path.join`, `fs` APIs, template engines, or
+> redirects without validation or path containment. To serve files from a
+> directory root, use
+> [`@fastify/static`](https://github.com/fastify/fastify-static) instead of
+> joining `request.params` into a filesystem path yourself. See also
+> [Request](./Request.md).
+
 To include a colon in a path without declaring a parameter, use a double colon.
 For example:
 ```js

package/fastify.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const VERSION = '5.11.2'
+const VERSION = '5.12.0'
 
 const Avvio = require('avvio')
 const http = require('node:http')

package/lib/content-type-parser.js

@@ -145,6 +145,10 @@ ContentTypeParser.prototype.getParser = function (contentType) {
 
   for (let j = 0; j !== this.parserRegExpList.length; ++j) {
     const parserRegExp = this.parserRegExpList[j]
+    // A parser registered with a `g`/`y` flagged RegExp keeps a mutable
+    // lastIndex between calls, so a plain `.test()` would skip part of the
+    // next content type and match inconsistently. Reset it before testing.
+    parserRegExp.lastIndex = 0
     if (parserRegExp.test(ct)) {
       parser = this.customParsers.get(parserRegExp.toString())
       this.cache.set(ct, parser)

package/lib/content-type.js

@@ -183,7 +183,10 @@ class ContentType {
 
   get isValid () { return this.#valid }
 
-  get mediaType () { return `${this.#type}/${this.#subtype}` }
+  get mediaType () {
+    if (this.#valid === false) return undefined
+    return `${this.#type}/${this.#subtype}`
+  }
 
   get type () { return this.#type }
 

package/lib/decorate.js

@@ -121,7 +121,7 @@ function checkDependencies (instance, name, deps) {
   }
 
   for (let i = 0; i !== deps.length; ++i) {
-    if (!checkExistence(instance, deps[i])) {
+    if (!checkExistence(instance, deps[i]) && !hasInstanceProperty(instance, deps[i])) {
       throw new FST_ERR_DEC_MISSING_DEPENDENCY(deps[i])
     }
   }

package/lib/log-controller.js

@@ -54,7 +54,7 @@ class LogController {
    * Logs the outcome of a completed request.
    * Uses `error` level when an error is present, `info` otherwise.
    *
-   * @param {Error | null} error  Error that occurred during the response, if any.
+   * @param {Error | null | undefined} error  Error that occurred during the response, if any.
    * @param {object} request      Fastify request object.
    * @param {object} reply        Fastify reply object.
    * @param {object} [metadata]   Extra contextual data (unused).

package/lib/reply.js

@@ -93,6 +93,12 @@ Object.defineProperties(Reply.prototype, {
       return (this[kReplyEndTime] || now()) - this[kReplyStartTime]
     }
   },
+  mediaType: {
+    get () {
+      const contentTypeHeader = this[kReplyHeaders]['content-type']
+      return ContentType.from(contentTypeHeader).mediaType
+    }
+  },
   server: {
     get () {
       return this.request[kRouteContext].server
@@ -254,9 +260,13 @@ Reply.prototype.hasHeader = function (key) {
 }
 
 Reply.prototype.removeHeader = function (key) {
+  key = key.toLowerCase()
   // Node.js does not like headers with keys set to undefined,
   // so we have to delete the key.
-  delete this[kReplyHeaders][key.toLowerCase()]
+  delete this[kReplyHeaders][key]
+  if (!this.raw.headersSent) {
+    this.raw.removeHeader(key)
+  }
   return this
 }
 
@@ -595,9 +605,13 @@ function onSendEnd (reply, payload) {
       header += ' '
       header += trailerName
     }
-    // it must be chunked for trailer to work
-    reply.header('Transfer-Encoding', 'chunked')
-    reply.header('Trailer', header.trim())
+    if (header !== '') {
+      // it must be chunked for trailer to work
+      reply.header('Transfer-Encoding', 'chunked')
+      reply.header('Trailer', header.trim())
+    } else {
+      reply[kReplyTrailers] = null
+    }
   }
 
   // since Response contain status code, headers and body,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastify",
-  "version": "5.11.2",
+  "version": "5.12.0",
   "description": "Fast and low overhead web framework, for Node.js",
   "main": "fastify.js",
   "type": "commonjs",
@@ -167,7 +167,6 @@
   ],
   "devDependencies": {
     "@jsumners/line-reporter": "^1.0.1",
-    "@sinonjs/fake-timers": "^11.2.2",
     "@stylistic/eslint-plugin": "^5.1.0",
     "@stylistic/eslint-plugin-js": "^4.1.0",
     "@types/node": "^26.0.1",
@@ -214,7 +213,7 @@
     "find-my-way": "^9.6.0",
     "light-my-request": "^6.0.0",
     "pino": "^9.14.0 || ^10.1.0",
-    "process-warning": "^5.0.0",
+    "process-warning": "^5.1.0",
     "rfdc": "^1.3.1",
     "secure-json-parse": "^4.0.0",
     "semver": "^7.6.0",

package/test/content-parser.test.js

@@ -1,9 +1,11 @@
 'use strict'
 
 const { test } = require('node:test')
+const { spyWarning } = require('process-warning')
 const Fastify = require('..')
 const keys = require('../lib/symbols')
 const { FST_ERR_CTP_ALREADY_PRESENT, FST_ERR_CTP_INVALID_TYPE, FST_ERR_CTP_INVALID_MEDIA_TYPE } = require('../lib/errors')
+const { FSTSEC001 } = require('../lib/warnings')
 
 const first = function (req, payload, done) {}
 const second = function (req, payload, done) {}
@@ -488,41 +490,37 @@ test('Safeguard against content-type spoofing - string', async t => {
 })
 
 test('Warning against improper content-type - regexp', async t => {
-  await t.test('improper regex - text plain', (t, done) => {
+  await t.test('improper regex - text plain', async (t) => {
     t.plan(2)
-    const fastify = Fastify()
+    const spyData = spyWarning(FSTSEC001)
+    t.after(spyData.restore)
 
-    process.on('warning', onWarning)
-    function onWarning (warning) {
-      t.assert.strictEqual(warning.name, 'FastifySecurity')
-      t.assert.strictEqual(warning.code, 'FSTSEC001')
-      done()
-    }
-    t.after(() => process.removeListener('warning', onWarning))
+    const fastify = Fastify()
 
     fastify.removeAllContentTypeParsers()
     fastify.addContentTypeParser(/text\/plain/, function (request, body, done) {
       done(null, body)
     })
+
+    await fastify.ready()
+    t.assert.deepStrictEqual(spyData.calls, [{ arguments: ['text\\/plain'], result: true }])
+    t.assert.strictEqual(spyData.callCount(), 1)
   })
 
-  await t.test('improper regex - application json', (t, done) => {
+  await t.test('improper regex - application json', async (t) => {
     t.plan(2)
+    const spyData = spyWarning(FSTSEC001)
+    t.after(spyData.restore)
     const fastify = Fastify()
 
-    process.on('warning', onWarning)
-    function onWarning (warning) {
-      t.assert.strictEqual(warning.name, 'FastifySecurity')
-      t.assert.strictEqual(warning.code, 'FSTSEC001')
-      done()
-    }
-    t.after(() => process.removeListener('warning', onWarning))
-
     fastify.removeAllContentTypeParsers()
 
     fastify.addContentTypeParser(/application\/json/, function (request, body, done) {
       done(null, body)
     })
+
+    t.assert.deepStrictEqual(spyData.calls, [{ arguments: ['application\\/json'], result: true }])
+    t.assert.deepEqual(spyData.callCount(), 1)
   })
 })
 
@@ -578,6 +576,38 @@ test('content-type match parameters - regexp', async t => {
   })
 })
 
+test('content-type match - RegExp with global flag', async t => {
+  t.plan(4)
+
+  const fastify = Fastify()
+  fastify.addContentTypeParser(/^application\/.+\+xml$/g, { parseAs: 'string' }, function (request, body, done) {
+    done(null, body)
+  })
+
+  fastify.post('/', async (request) => request.body)
+
+  // Two distinct content types that both match the parser. A RegExp with the
+  // `g` flag keeps a mutable lastIndex between test() calls, so the second
+  // content type must still match rather than fall through to 415.
+  const first = await fastify.inject({
+    method: 'POST',
+    path: '/',
+    headers: { 'content-type': 'application/vnd.a+xml' },
+    body: '<a/>'
+  })
+  const second = await fastify.inject({
+    method: 'POST',
+    path: '/',
+    headers: { 'content-type': 'application/vnd.b+xml' },
+    body: '<b/>'
+  })
+
+  t.assert.strictEqual(first.statusCode, 200)
+  t.assert.strictEqual(first.payload, '<a/>')
+  t.assert.strictEqual(second.statusCode, 200)
+  t.assert.strictEqual(second.payload, '<b/>')
+})
+
 test('content-type fail when parameters not match - string 1', async t => {
   t.plan(1)
 

package/test/content-type.test.js

@@ -46,18 +46,22 @@ describe('ContentType class', () => {
   test('returns empty instance for empty value', (t) => {
     let found = new ContentType('')
     t.assert.equal(found.isEmpty, true)
+    t.assert.equal(found.mediaType, undefined)
 
     found = new ContentType('undefined')
     t.assert.equal(found.isEmpty, true)
+    t.assert.equal(found.mediaType, undefined)
 
     found = new ContentType()
     t.assert.equal(found.isEmpty, true)
+    t.assert.equal(found.mediaType, undefined)
   })
 
   test('indicates media type is not correct format', (t) => {
     let found = new ContentType('foo')
     t.assert.equal(found.isEmpty, true)
     t.assert.equal(found.isValid, false)
+    t.assert.equal(found.mediaType, undefined)
 
     found = new ContentType('foo /bar')
     t.assert.equal(found.isEmpty, true)

package/test/decorator-instance-properties.test.js

@@ -61,3 +61,52 @@ test('decorateRequest still works for non-built-in names', (t, done) => {
     done()
   })
 })
+
+test('decorateRequest accepts built-in request properties as dependencies', t => {
+  t.plan(6)
+  const fastify = Fastify()
+  for (const name of ['id', 'params', 'raw', 'query', 'log', 'body']) {
+    t.assert.doesNotThrow(() => fastify.decorateRequest(`uses_${name}`, null, [name]))
+  }
+})
+
+test('decorateReply accepts built-in reply properties as dependencies', t => {
+  t.plan(3)
+  const fastify = Fastify()
+  for (const name of ['raw', 'request', 'log']) {
+    t.assert.doesNotThrow(() => fastify.decorateReply(`uses_${name}`, null, [name]))
+  }
+})
+
+test('decorateRequest accepts built-in properties as dependencies inside a plugin', (t, done) => {
+  t.plan(2)
+  const fastify = Fastify()
+  fastify.register(async (instance) => {
+    instance.decorateRequest('scopedExtra', null, ['body'])
+    t.assert.equal(instance.hasRequestDecorator('scopedExtra'), true)
+  })
+  fastify.ready((err) => {
+    t.assert.ifError(err)
+    done()
+  })
+})
+
+test('decorateRequest accepts built-in properties mixed with user decorators as dependencies', t => {
+  t.plan(1)
+  const fastify = Fastify()
+  fastify.decorateRequest('userProp', null)
+  t.assert.doesNotThrow(() => fastify.decorateRequest('mixed', null, ['userProp', 'body']))
+})
+
+test('decorateRequest still throws FST_ERR_DEC_MISSING_DEPENDENCY for unknown dependencies', t => {
+  t.plan(2)
+  const fastify = Fastify()
+  t.assert.throws(
+    () => fastify.decorateRequest('withUnknown', null, ['nonExistent']),
+    (err) => err.code === 'FST_ERR_DEC_MISSING_DEPENDENCY'
+  )
+  t.assert.throws(
+    () => fastify.decorateReply('withUnknown', null, ['body']),
+    (err) => err.code === 'FST_ERR_DEC_MISSING_DEPENDENCY'
+  )
+})