fastify 5.11.2 → 6.0.0-alpha.0

package/README.md

@@ -46,8 +46,8 @@ developer experience with the least overhead and a powerful plugin architecture.
 It is inspired by Hapi and Express and as far as we know, it is one of the
 fastest web frameworks in town.
 
-The `main` branch refers to the Fastify `v5` release.
-Check out the [`4.x` branch](https://github.com/fastify/fastify/tree/4.x) for `v4`.
+The `main` branch refers to the Fastify `v6` release.
+Check out the [`5.x` branch](https://github.com/fastify/fastify/tree/5.x) for `v5`.
 
 ### Table of Contents
 
@@ -73,7 +73,7 @@ mkdir my-app
 cd my-app
 ```
 
-Generate a fastify project with `npm init`:
+Generate a Fastify project with `npm init`:
 
 ```sh
 npm init fastify
@@ -121,7 +121,7 @@ import Fastify from 'fastify'
 const fastify = Fastify({
   logger: true
 })
-// CommonJs
+// CommonJS
 const fastify = require('fastify')({
   logger: true
 })
@@ -147,7 +147,7 @@ import Fastify from 'fastify'
 const fastify = Fastify({
   logger: true
 })
-// CommonJs
+// CommonJS
 const fastify = require('fastify')({
   logger: true
 })
@@ -181,7 +181,7 @@ If you learn best by reading code, explore the official [demo](https://github.co
 ### Core features
 
 - **Highly performant:** as far as we know, Fastify is one of the fastest web
-  frameworks in town, depending on the code complexity we can serve up to 76+
+  frameworks in town, depending on the code complexity we can serve more than 76
   thousand requests per second.
 - **Extensible:** Fastify is fully extensible via its hooks, plugins, and
   decorators.
@@ -189,7 +189,7 @@ If you learn best by reading code, explore the official [demo](https://github.co
   Schema](https://json-schema.org/) to validate your routes and serialize your
   outputs. Internally Fastify compiles the schema in a highly performant
   function.
-- **Logging:** logs are extremely important but are costly; we chose the best
+- **Logging:** logs are extremely important, but are costly; we chose the best
   logger to almost remove this cost, [Pino](https://github.com/pinojs/pino)!
 - **Developer friendly:** the framework is built to be very expressive and help
   developers in their daily use without sacrificing performance and
@@ -212,8 +212,8 @@ second average
 | -                  |                            |              |               |
 | `http.Server`      | 16.14.2	                  | ✗     | 74,513        |
 
-These benchmarks taken using https://github.com/fastify/benchmarks. This is a
-synthetic "hello world" benchmark that aims to evaluate the framework overhead.
+These benchmarks were taken using https://github.com/fastify/benchmarks. This is
+a synthetic "hello world" benchmark that aims to evaluate the framework overhead.
 The overhead that each framework has on your application depends on your
 application. You should __always__ benchmark if performance matters to you.
 

package/SPONSORS.md

@@ -19,6 +19,7 @@ or [GitHub Sponsors](https://github.com/sponsors/fastify)!
 - [atagon GmbH](https://github.com/atagon-GmbH)
 - [Photon](https://github.com/photon-hq)
 - [N-iX](https://www.n-ix.com/)
+- [TestMu AI](https://www.testmuai.com/?utm_medium=sponsor&utm_source=fastify)
 
 ## Tier 2
 

package/build/build-validation.js

@@ -30,26 +30,19 @@ const defaultInitOptions = {
   requestTimeout: 0, // no limit
   handlerTimeout: 0, // no timeout (disabled by default)
   bodyLimit: 1024 * 1024, // 1 MiB
-  caseSensitive: true,
-  allowUnsafeRegex: false,
-  disableRequestLogging: false, // TODO: remove it in v6
-  ignoreTrailingSlash: false,
-  ignoreDuplicateSlashes: false,
-  maxParamLength: 100,
   onProtoPoisoning: 'error',
   onConstructorPoisoning: 'error',
   pluginTimeout: 10000,
   requestIdHeader: false,
-  requestIdLogLabel: 'reqId', // TODO: remove it in v6
   http2SessionTimeout: 72000, // 72 seconds
   exposeHeadRoutes: true,
-  useSemicolonDelimiter: false,
-  allowErrorHandlerOverride: true, // TODO: set to false in v6
+  allowErrorHandlerOverride: false,
   routerOptions: {
+    allowUnsafeRegex: false,
+    caseSensitive: true,
     ignoreTrailingSlash: false,
     ignoreDuplicateSlashes: false,
     maxParamLength: 100,
-    allowUnsafeRegex: false,
     useSemicolonDelimiter: false
   }
 }
@@ -75,8 +68,6 @@ const schema = {
     requestTimeout: { type: 'integer', default: defaultInitOptions.requestTimeout },
     handlerTimeout: { type: 'integer', default: defaultInitOptions.handlerTimeout },
     bodyLimit: { type: 'integer', default: defaultInitOptions.bodyLimit },
-    caseSensitive: { type: 'boolean', default: defaultInitOptions.caseSensitive },
-    allowUnsafeRegex: { type: 'boolean', default: defaultInitOptions.allowUnsafeRegex },
     http2: { type: 'boolean' },
     https: {
       if: {
@@ -99,42 +90,37 @@ const schema = {
     },
     ignoreTrailingSlash: { type: 'boolean', default: defaultInitOptions.ignoreTrailingSlash },
     ignoreDuplicateSlashes: { type: 'boolean', default: defaultInitOptions.ignoreDuplicateSlashes },
-    disableRequestLogging: {
-      default: false
-    },
-    maxParamLength: { type: 'integer', default: defaultInitOptions.maxParamLength },
     onProtoPoisoning: { type: 'string', default: defaultInitOptions.onProtoPoisoning },
     onConstructorPoisoning: { type: 'string', default: defaultInitOptions.onConstructorPoisoning },
     pluginTimeout: { type: 'integer', default: defaultInitOptions.pluginTimeout },
     requestIdHeader: { anyOf: [{ type: 'boolean' }, { type: 'string' }], default: defaultInitOptions.requestIdHeader },
-    requestIdLogLabel: { type: 'string', default: defaultInitOptions.requestIdLogLabel },
     http2SessionTimeout: { type: 'integer', default: defaultInitOptions.http2SessionTimeout },
     exposeHeadRoutes: { type: 'boolean', default: defaultInitOptions.exposeHeadRoutes },
-    useSemicolonDelimiter: { type: 'boolean', default: defaultInitOptions.useSemicolonDelimiter },
     routerOptions: {
       type: 'object',
-      additionalProperties: true,
+      additionalProperties: false,
       properties: {
+        allowUnsafeRegex: { type: 'boolean', default: defaultInitOptions.routerOptions.allowUnsafeRegex },
+        caseSensitive: { type: 'boolean', default: defaultInitOptions.routerOptions.caseSensitive },
+        constraints: {
+          type: 'object',
+          additionalProperties: {
+            type: 'object',
+            required: ['name', 'storage', 'validate', 'deriveConstraint'],
+            additionalProperties: true,
+            properties: {
+              name: { type: 'string' },
+              storage: {},
+              validate: {},
+              deriveConstraint: {}
+            }
+          }
+        },
         ignoreTrailingSlash: { type: 'boolean', default: defaultInitOptions.routerOptions.ignoreTrailingSlash },
         ignoreDuplicateSlashes: { type: 'boolean', default: defaultInitOptions.routerOptions.ignoreDuplicateSlashes },
         maxParamLength: { type: 'integer', default: defaultInitOptions.routerOptions.maxParamLength },
-        allowUnsafeRegex: { type: 'boolean', default: defaultInitOptions.routerOptions.allowUnsafeRegex },
         useSemicolonDelimiter: { type: 'boolean', default: defaultInitOptions.routerOptions.useSemicolonDelimiter }
       }
-    },
-    constraints: {
-      type: 'object',
-      additionalProperties: {
-        type: 'object',
-        required: ['name', 'storage', 'validate', 'deriveConstraint'],
-        additionalProperties: true,
-        properties: {
-          name: { type: 'string' },
-          storage: {},
-          validate: {},
-          deriveConstraint: {}
-        }
-      }
     }
   }
 }

package/docs/Guides/Getting-Started.md

@@ -303,7 +303,7 @@ export default fastifyPlugin(dbConnector)
 ```js
 // CommonJs
 /**
- * @type {import('fastify-plugin').FastifyPlugin}
+ * @type {import('fastify-plugin').FastifyPluginAsync}
  */
 const fastifyPlugin = require('fastify-plugin')
 
@@ -616,5 +616,5 @@ npm start
     speed](https://www.youtube.com/watch?v=5z46jJZNe8k) by
     [@mcollina](https://github.com/mcollina)
   - [What if I told you that HTTP can be
-    fast](https://www.webexpo.net/prague2017/talk/what-if-i-told-you-that-http-can-be-fast/)
+    fast](https://web.archive.org/web/20251006142253/https://www.webexpo.net/prague2017/talk/what-if-i-told-you-that-http-can-be-fast/)
     by [@delvedor](https://github.com/delvedor)

package/docs/Guides/Serverless.md

@@ -256,9 +256,41 @@ curl -X POST https://$GOOGLE_REGION-$GOOGLE_PROJECT.cloudfunctions.net/me \
 {"message":"Hello Fastify!"}
 ```
 
+#### Per-route logging
+
+Google Cloud Functions exposes one entry point for your Fastify instance, so
+the dashboard may show all HTTP traffic under that function. Instead of
+deploying one function per endpoint, keep the single Fastify instance and emit
+a structured log line after each request with the matched route:
+
+```js
+fastify.addHook('onResponse', async (request, reply) => {
+  request.log.info({
+    route: request.routeOptions.url,
+    method: request.method,
+    statusCode: reply.statusCode,
+    responseTime: reply.elapsedTime
+  }, 'request completed')
+})
+```
+
+`request.routeOptions.url` is the route pattern, so `/users/123` and
+`/users/456` are grouped under `/users/:id`. With Fastify's logger enabled, the
+fields are emitted as structured log fields, as described in the [Cloud
+Logging structured logging documentation](https://cloud.google.com/logging/docs/structured-logging)
+and the [Cloud Functions logging guide](https://cloud.google.com/functions/docs/monitoring/logging).
+In Cloud Logging, create a [log-based
+metric](https://cloud.google.com/logging/docs/logs-based-metrics) or filter on
+`jsonPayload.route` to get per-route request counts, latency, and error rates.
+
+The same hook works when deploying through Firebase Functions with `onRequest`.
+
 ### References
 - [Google Cloud Functions - Node.js Quickstart
-  ](https://docs.cloud.google.com/run/docs/quickstarts/functions/deploy-functions-gcloud)
+  ](https://cloud.google.com/run/docs/quickstarts/functions/deploy-functions-gcloud)
+- [Cloud Logging - Structured Logging](https://cloud.google.com/logging/docs/structured-logging)
+- [Cloud Logging - Log-based Metrics](https://cloud.google.com/logging/docs/logs-based-metrics)
+- [Cloud Functions - Logging](https://cloud.google.com/functions/docs/monitoring/logging)
 
 ## Google Firebase Functions
 
@@ -594,4 +626,4 @@ https://vercel.com/templates/backend/fastify-on-vercel).
 [Fluid compute](https://vercel.com/docs/fluid-compute) currently
 requires an explicit opt-in. Learn more about enabling Fluid compute
 [here](
-https://vercel.com/docs/fluid-compute#enabling-fluid-compute).
+https://vercel.com/docs/fluid-compute#enabling-fluid-compute).

package/docs/Reference/Encapsulation.md

@@ -140,7 +140,7 @@ update the code as follows:
 'use strict'
 
 const fastify = require('fastify')()
-const fastifyPlugin = require('fastify-plugin')
+const fp = require('fastify-plugin')
 
 fastify.decorateRequest('answer', 42)
 
@@ -161,7 +161,7 @@ fastify.register(async function publicContext (childServer) {
     }
   })
 
-  childServer.register(fastifyPlugin(grandchildContext))
+  childServer.register(fp(grandchildContext))
 
   async function grandchildContext (grandchildServer) {
     grandchildServer.decorateRequest('bar', 'bar')
@@ -192,4 +192,33 @@ curl http://127.0.0.1:8000/three
 # {"answer":42,"foo":"foo","bar":"bar"}
 ```
 
+`fastify-plugin` breaks encapsulation only for the plugin it wraps. Plugins
+registered inside it without `fastify-plugin` still create new encapsulated
+contexts:
+
+```js
+'use strict'
+
+const fastify = require('fastify')()
+const fp = require('fastify-plugin')
+
+fastify.register(fp(async function sharedContext (childServer) {
+  childServer.decorate('foo', 'foo')
+
+  childServer.register(async function encapsulatedContext (grandchildServer) {
+    grandchildServer.decorate('bar', 'bar')
+  })
+}))
+
+await fastify.ready()
+
+console.log(fastify.foo) // 'foo'
+console.log(fastify.bar) // undefined
+```
+
+The `foo` decorator is available in the root context because it is added
+directly by the plugin wrapped with `fastify-plugin`. The nested `register`
+call still creates a grandchild context, so the `bar` decorator remains
+available only in that context and its children.
+
 [fastify-plugin]: https://github.com/fastify/fastify-plugin

package/docs/Reference/Errors.md

@@ -11,6 +11,7 @@
   - [Errors In Fastify](#errors-in-fastify)
     - [Errors In Input Data](#errors-in-input-data)
     - [Catching Uncaught Errors In Fastify](#catching-uncaught-errors-in-fastify)
+    - [What The Default Error Handler Sends](#what-the-default-error-handler-sends)
   - [Errors In Fastify Lifecycle Hooks And A Custom Error Handler](#errors-in-fastify-lifecycle-hooks-and-a-custom-error-handler)
   - [Fastify Error Codes](#fastify-error-codes)
     - [FST_ERR_NOT_FOUND](#fst_err_not_found)
@@ -31,7 +32,7 @@
     - [FST_ERR_CTP_EMPTY_JSON_BODY](#fst_err_ctp_empty_json_body)
     - [FST_ERR_CTP_INVALID_JSON_BODY](#fst_err_ctp_invalid_json_body)
     - [FST_ERR_CTP_INSTANCE_ALREADY_STARTED](#fst_err_ctp_instance_already_started)
-    - [FST_ERR_INSTANCE_ALREADY_LISTENING](#fst_err_instance_already_listening)
+    - [FST_ERR_INSTANCE_ALREADY_STARTED](#fst_err_instance_already_started)
     - [FST_ERR_DEC_ALREADY_PRESENT](#fst_err_dec_already_present)
     - [FST_ERR_DEC_DEPENDENCY_INVALID_TYPE](#fst_err_dec_dependency_invalid_type)
     - [FST_ERR_DEC_MISSING_DEPENDENCY](#fst_err_dec_missing_dependency)
@@ -83,6 +84,7 @@
     - [FST_ERR_ROUTE_HANDLER_NOT_FN](#fst_err_route_handler_not_fn)
     - [FST_ERR_ROUTE_MISSING_HANDLER](#fst_err_route_missing_handler)
     - [FST_ERR_ROUTE_METHOD_INVALID](#fst_err_route_method_invalid)
+    - [FST_ERR_ROUTE_METHOD_ALREADY_SUPPORTED](#fst_err_route_method_already_supported)
     - [FST_ERR_ROUTE_METHOD_NOT_SUPPORTED](#fst_err_route_method_not_supported)
     - [FST_ERR_ROUTE_LOG_LEVEL_INVALID](#fst_err_route_log_level_invalid)
     - [FST_ERR_ROUTE_BODY_VALIDATION_SCHEMA_NOT_SUPPORTED](#fst_err_route_body_validation_schema_not_supported)
@@ -142,10 +144,82 @@ performance. This includes:
    })`
 
 In both cases, the error will be caught safely and routed to Fastify's default
-error handler, resulting in a generic `500 Internal Server Error` response.
+error handler, resulting in a `500 Internal Server Error` response.
 
-To customize this behavior, use
-[`setErrorHandler`](./Server.md#seterrorhandler).
+#### What The Default Error Handler Sends
+The default error handler serializes the error into a JSON body with the
+`statusCode`, `error`, and `message` properties, plus `code` when the error
+carries one:
+
+```js
+app.get('/', async () => { throw new Error('kaboom') })
+```
+
+```json
+{
+  "statusCode": 500,
+  "error": "Internal Server Error",
+  "message": "kaboom"
+}
+```
+
+The `error` property is the generic HTTP status text, but **`message` is
+`error.message` verbatim**. This applies to every status code, including `500`.
+Fastify's built-in error serializer emits only these four properties, so the
+stack trace is not part of the default payload — but a route-level response
+schema replaces that serializer, and one that declares a `stack` property will
+serialize it.
+
+> Security:
+> Because `message` and `code` are forwarded as-is, errors thrown by libraries
+> deeper in your application are exposed to the client. A database driver
+> error, for example, can leak schema details and query text:
+>
+> ```json
+> {
+>   "statusCode": 500,
+>   "code": "ER_BAD_FIELD_ERROR",
+>   "error": "Internal Server Error",
+>   "message": "Unknown column 'username' in 'field list'"
+> }
+> ```
+>
+> Fastify does not distinguish between development and production here. If
+> unexpected errors must not reach the client, handle this explicitly.
+
+Register a [`setErrorHandler`](./Server.md#seterrorhandler) to replace the
+message for errors you did not raise deliberately, while letting the ones you
+did pass through:
+
+```js
+app.setErrorHandler(function (error, request, reply) {
+  // Errors with a statusCode below 500 were raised deliberately by this
+  // application, as were validation errors. A status code below 500 is not on
+  // its own a guarantee that the message is safe to expose — narrow this
+  // condition if any of yours are not.
+  if (error.validation || (error.statusCode && error.statusCode < 500)) {
+    return reply.send(error)
+  }
+
+  // Anything else is unexpected: log it, but do not describe it to the client.
+  this.log.error({ err: error }, 'unhandled error')
+  reply.status(500).send({
+    statusCode: 500,
+    error: 'Internal Server Error',
+    message: 'Internal Server Error'
+  })
+})
+```
+
+The handler above is registered on the root instance, so it applies to every
+route. Error handlers are encapsulated; for how they resolve across plugin
+contexts, see
+[the next section](#errors-in-fastify-lifecycle-hooks-and-a-custom-error-handler).
+
+Note that a route-level response schema is still applied to whatever the error
+handler sends, and will reshape the payload accordingly — including properties
+the built-in error serializer would have omitted, such as `stack`. See
+[Serialization](./Validation-and-Serialization.md#serialization).
 
 ### Errors In Fastify Lifecycle Hooks And A Custom Error Handler
 
@@ -312,7 +386,7 @@ Below is a table with all the error codes used by Fastify.
 | <a id="fst_err_ctp_empty_json_body">FST_ERR_CTP_EMPTY_JSON_BODY</a> | Body is not valid JSON but content-type is set to <code>application/json</code>. | Check if the request body is valid JSON. | [#5925](https://github.com/fastify/fastify/pull/5925) |
 | <a id="fst_err_ctp_invalid_json_body">FST_ERR_CTP_INVALID_JSON_BODY</a> | Body cannot be empty when content-type is set to <code>application/json</code>. | Check the request body. | [#1253](https://github.com/fastify/fastify/pull/1253) |
 | <a id="fst_err_ctp_instance_already_started">FST_ERR_CTP_INSTANCE_ALREADY_STARTED</a> | Fastify is already started. | - | [#4554](https://github.com/fastify/fastify/pull/4554) |
-| <a id="fst_err_instance_already_listening">FST_ERR_INSTANCE_ALREADY_LISTENING</a> | Fastify instance is already listening. | - | [#4554](https://github.com/fastify/fastify/pull/4554) |
+| <a id="fst_err_instance_already_started">FST_ERR_INSTANCE_ALREADY_STARTED</a> | Fastify instance is already started. | - | [#6098](https://github.com/fastify/fastify/pull/6098) |
 | <a id="fst_err_dec_already_present">FST_ERR_DEC_ALREADY_PRESENT</a> | A decorator with the same name is already registered. | Use a different decorator name. | [#1168](https://github.com/fastify/fastify/pull/1168) |
 | <a id="fst_err_dec_dependency_invalid_type">FST_ERR_DEC_DEPENDENCY_INVALID_TYPE</a> | The dependencies of decorator must be of type `Array`. | Use an array for the dependencies. | [#3090](https://github.com/fastify/fastify/pull/3090) |
 | <a id="fst_err_dec_missing_dependency">FST_ERR_DEC_MISSING_DEPENDENCY</a> | The decorator cannot be registered due to a missing dependency. | Register the missing dependency. | [#1168](https://github.com/fastify/fastify/pull/1168) |
@@ -364,6 +438,7 @@ Below is a table with all the error codes used by Fastify.
 | <a id="fst_err_route_handler_not_fn">FST_ERR_ROUTE_HANDLER_NOT_FN</a> | Handler for the route must be a function. | Use a function for the handler. | [#4554](https://github.com/fastify/fastify/pull/4554) |
 | <a id="fst_err_route_missing_handler">FST_ERR_ROUTE_MISSING_HANDLER</a> | Missing handler function for the route. | Add a handler function. | [#4554](https://github.com/fastify/fastify/pull/4554) |
 | <a id="fst_err_route_method_invalid">FST_ERR_ROUTE_METHOD_INVALID</a> | Method is not a valid value. | Use a valid value for the method. | [#4750](https://github.com/fastify/fastify/pull/4750) |
+| <a id="fst_err_route_method_already_supported">FST_ERR_ROUTE_METHOD_ALREADY_SUPPORTED</a> | The HTTP method is already supported. | Pass `{ overrideExisting: true }` to explicitly override it. | [#6909](https://github.com/fastify/fastify/pull/6909) |
 | <a id="fst_err_route_method_not_supported">FST_ERR_ROUTE_METHOD_NOT_SUPPORTED</a> | Method is not supported for the route. | Use a supported method. | [#4554](https://github.com/fastify/fastify/pull/4554) |
 | <a id="fst_err_route_log_level_invalid">FST_ERR_ROUTE_LOG_LEVEL_INVALID</a> | `logLevel` must match a configured logger level. | Use one of the configured logger levels for the route. | [#6523](https://github.com/fastify/fastify/pull/6523) |
 | <a id="fst_err_route_body_validation_schema_not_supported">FST_ERR_ROUTE_BODY_VALIDATION_SCHEMA_NOT_SUPPORTED</a> | Body validation schema route is not supported. | Use a different different method for the route. | [#4554](https://github.com/fastify/fastify/pull/4554) |
@@ -374,7 +449,7 @@ Below is a table with all the error codes used by Fastify.
 | <a id="fst_err_route_missing_content_type">FST_ERR_ROUTE_MISSING_CONTENT_TYPE</a> | `Content-Type` header is required for the request. | Send request with `Content-Type` header. | [#6832](https://github.com/fastify/fastify/pull/6832) |
 | <a id="fst_err_route_missing_content">FST_ERR_ROUTE_MISSING_CONTENT</a> | Body is required for the request. | Send request with payload. | [#6832](https://github.com/fastify/fastify/pull/6832) |
 | <a id="fst_err_reopened_close_server">FST_ERR_REOPENED_CLOSE_SERVER</a> | Fastify has already been closed and cannot be reopened. | - | [#2415](https://github.com/fastify/fastify/pull/2415) |
-| <a id="fst_err_reopened_server">FST_ERR_REOPENED_SERVER</a> | Fastify is already listening. | - | [#2415](https://github.com/fastify/fastify/pull/2415) |
+| <a id="fst_err_reopened_server">FST_ERR_REOPENED_SERVER</a> | Fastify is already started. | - | [#2415](https://github.com/fastify/fastify/pull/2415) |
 | <a id="fst_err_plugin_version_mismatch">FST_ERR_PLUGIN_VERSION_MISMATCH</a> | Installed Fastify plugin mismatched expected version. | Use a compatible version of the plugin. | [#2549](https://github.com/fastify/fastify/pull/2549) |
 | <a id="fst_err_plugin_callback_not_fn">FST_ERR_PLUGIN_CALLBACK_NOT_FN</a> | Callback for a hook is not a function. | Use a function for the callback. | [#3106](https://github.com/fastify/fastify/pull/3106) |
 | <a id="fst_err_plugin_not_valid">FST_ERR_PLUGIN_NOT_VALID</a> | Plugin must be a function or a promise. | Use a function or a promise for the plugin. | [#3106](https://github.com/fastify/fastify/pull/3106) |

package/docs/Reference/Hooks.md

@@ -260,10 +260,6 @@ The `onResponse` hook is executed when a response has been sent, so you will not
 be able to send more data to the client. It can however be useful for sending
 data to external services, for example, to gather statistics.
 
-> ℹ️ Note:
-> Setting `disableRequestLogging` to `true` will disable any error log
-> inside the `onResponse` hook. In this case use `try - catch` to log errors.
-
 ### onTimeout
 
 ```js

package/docs/Reference/LTS.md

@@ -60,7 +60,8 @@ For more information, see the [Never Ending Support][hd-link] service offered.
 | 2.0.0   | 2019-02-25   | 2021-01-31      | 6, 8, 10, 12, 14   |                |
 | 3.0.0   | 2020-07-07   | 2023-06-30      | 10, 12, 14, 16, 18 | v5(18)         |
 | 4.0.0   | 2022-06-08   | 2025-06-30      | 14, 16, 18, 20, 22 | v5(18), v5(20) |
-| 5.0.0   | 2024-09-17   | TBD             | 20, 22             | v5(20)         |
+| 5.0.0   | 2024-09-17   | TBD             | 20, 22, 24, 26     | v5(20)         |
+| 6.0.0   | TDB          | TBD             | 24, 26             | v6(24)         |
 
 ### CI Tested Operating Systems
 <a id="supported-os"></a>
@@ -73,10 +74,10 @@ YAML workflow labels below:
 
 | OS      | YAML Workflow Label | Package Manager | Node.js     | Nsolid(Node)  |
 | ------- | ------------------- | --------------- | ----------- | ------------- |
-| Linux   | `ubuntu-latest`     | npm             | 20          | v5(20)        |
-| Linux   | `ubuntu-latest`     | yarn,pnpm       | 20          | v5(20)        |
-| Windows | `windows-latest`    | npm             | 20          | v5(20)        |
-| MacOS   | `macos-latest`      | npm             | 20          | v5(20)        |
+| Linux   | `ubuntu-latest`     | npm             | 24          | v6(24)        |
+| Linux   | `ubuntu-latest`     | yarn,pnpm       | 24          | v6(24)        |
+| Windows | `windows-latest`    | npm             | 24          | v6(24)        |
+| MacOS   | `macos-latest`      | npm             | 24          | v6(24)        |
 
 When using [yarn](https://yarnpkg.com/), the `--ignore-engines` flag may be required.
 

package/docs/Reference/Request.md

@@ -9,7 +9,11 @@ Request is a core Fastify object containing the following fields:
 - `body` - The request payload, see [Content-Type Parser](./ContentTypeParser.md)
   for details on what request payloads Fastify natively parses and how to support
   other content types.
-- `params` - The params matching the URL.
+- `params` - The params matching the URL. Values are percent-decoded
+  (for example `%20` becomes a space, and `%2f` becomes `/`). Decoded
+  values may contain `.`, `..`, `/`, or other characters; treat them as
+  untrusted input. See the security note below and
+  [Routes - Url building](./Routes.md#url-building).
 - [`headers`](#headers) - The headers getter and setter.
 - `raw` - The incoming HTTP request from Node core.
 - `server` - The Fastify server instance, scoped to the current
@@ -35,13 +39,21 @@ Request is a core Fastify object containing the following fields:
   [`trustProxy`](./Server.md#factory-trust-proxy) is enabled).
 
 > ⚠️ Security:
+> `request.params`, `request.query`, `request.headers`, and `request.body`
+> are untrusted network input. Route parameter values are percent-decoded
+> before your handler runs, so a segment like `..%2ffile` becomes `../file`
+> in `request.params`. Do not use parameter values as filesystem paths,
+> template names, or redirect targets without validating or containing
+> them. Prefer [`@fastify/static`](https://github.com/fastify/fastify-static)
+> (or `reply.sendFile`) when serving files from a root directory.
+>
 > `request.ip`, `request.ips`, `request.host`, `request.hostname`,
 > `request.port`, and `request.protocol` come from request metadata
-> (socket and/or forwarding headers) and should be treated as untrusted input.
-> Fastify does not perform security validation for business logic.
-> If these values are used in security-sensitive decisions, they must 
-> be validated explicitly (for example: trusted proxy configuration,
-> allow-lists, strict parsing, and normalization).
+> (socket and/or forwarding headers) and should also be treated as
+> untrusted input. Fastify does not perform security validation for
+> business logic. If these values are used in security-sensitive decisions,
+> they must be validated explicitly (for example: trusted proxy
+> configuration, allow-lists, strict parsing, and normalization).
 
 - `method` - The method of the incoming request.
 - `url` - The URL of the incoming request.

package/docs/Reference/Routes.md

@@ -328,6 +328,19 @@ Prefer a single parameter approach, especially on routes that are on the hot
 path of your application. For more details, see
 [find-my-way](https://github.com/delvedor/find-my-way).
 
+> ⚠️ Security:
+> Fastify (via find-my-way) percent-decodes route parameters and wildcards
+> before they reach your handler. Encoded separators in a segment are
+> decoded in the parameter value: for a route `/download/:file`, a request
+> to `/download/..%2fsecret.txt` yields
+> `request.params.file === '../secret.txt'`. Parameters are untrusted
+> input. Do not pass them to `path.join`, `fs` APIs, template engines, or
+> redirects without validation or path containment. To serve files from a
+> directory root, use
+> [`@fastify/static`](https://github.com/fastify/fastify-static) instead of
+> joining `request.params` into a filesystem path yourself. See also
+> [Request](./Request.md).
+
 To include a colon in a path without declaring a parameter, use a double colon.
 For example:
 ```js