fastify 5.11.3 → 5.12.1

package/fastify.d.ts

@@ -149,7 +149,7 @@ declare namespace fastify {
     requestIdLogLabel?: string;
     useSemicolonDelimiter?: boolean,
     genReqId?: (req: RawRequestDefaultExpression<RawServer>) => string,
-    trustProxy?: boolean | string | string[] | number | TrustProxyFunction,
+    trustProxy?: boolean | string | string[] | TrustProxyFunction,
     querystringParser?: (str: string) => { [key: string]: unknown },
     constraints?: {
       [name: string]: ConstraintStrategy<FindMyWayVersion<RawServer>, unknown>,

package/fastify.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const VERSION = '5.11.3'
+const VERSION = '5.12.1'
 
 const Avvio = require('avvio')
 const http = require('node:http')
@@ -601,7 +601,7 @@ function fastify (serverOptions) {
 
     if (name === 'onClose') {
       this.onClose(fn.bind(this))
-    } else if (name === 'onReady' || name === 'onListen' || name === 'onRoute') {
+    } else if (name === 'onReady' || name === 'onListen' || name === 'onRoute' || name === 'preClose') {
       this[kHooks].add(name, fn)
     } else {
       this.after((err, done) => {

package/lib/content-type.js

@@ -183,7 +183,10 @@ class ContentType {
 
   get isValid () { return this.#valid }
 
-  get mediaType () { return `${this.#type}/${this.#subtype}` }
+  get mediaType () {
+    if (this.#valid === false) return undefined
+    return `${this.#type}/${this.#subtype}`
+  }
 
   get type () { return this.#type }
 

package/lib/reply.js

@@ -93,6 +93,12 @@ Object.defineProperties(Reply.prototype, {
       return (this[kReplyEndTime] || now()) - this[kReplyStartTime]
     }
   },
+  mediaType: {
+    get () {
+      const contentTypeHeader = this[kReplyHeaders]['content-type']
+      return ContentType.from(contentTypeHeader).mediaType
+    }
+  },
   server: {
     get () {
       return this.request[kRouteContext].server
@@ -254,9 +260,13 @@ Reply.prototype.hasHeader = function (key) {
 }
 
 Reply.prototype.removeHeader = function (key) {
+  key = key.toLowerCase()
   // Node.js does not like headers with keys set to undefined,
   // so we have to delete the key.
-  delete this[kReplyHeaders][key.toLowerCase()]
+  delete this[kReplyHeaders][key]
+  if (!this.raw.headersSent) {
+    this.raw.removeHeader(key)
+  }
   return this
 }
 

package/lib/request.js

@@ -49,8 +49,9 @@ function getTrustProxyFn (tp) {
     return function () { return true }
   }
   if (typeof tp === 'number') {
-    // Support trusting hop count
-    return function (a, i) { return i < tp }
+    // Hop-count-only trust cannot validate the immediate peer. Fail closed so
+    // direct clients cannot spoof X-Forwarded-* values by supplying enough hops.
+    return function () { return false }
   }
   if (typeof tp === 'string') {
     // Support comma-separated tps

package/lib/route.js

@@ -290,6 +290,7 @@ function buildRouting (options) {
         opts.attachValidation = false
       }
 
+      const routeConfigUrl = prefixing ? prefix : url
       if (prefixing === false) {
         // run 'onRoute' hooks
         for (const hook of this[kHooks].onRoute) {
@@ -328,7 +329,7 @@ function buildRouting (options) {
       const constraints = opts.constraints || {}
       const config = {
         ...opts.config,
-        url,
+        url: routeConfigUrl,
         method: opts.method
       }
 

package/lib/validation.js

@@ -120,7 +120,16 @@ function validateParam (validatorFunction, request, paramName) {
   let ret
 
   try {
-    ret = validatorFunction?.(isUndefined ? null : request[paramName])
+    const data = isUndefined ? null : request[paramName]
+    // Ajv can only mutate a root value when its parent is provided.
+    if (validatorFunction?.schemaEnv) {
+      ret = validatorFunction(data, {
+        parentData: request,
+        parentDataProperty: paramName
+      })
+    } else {
+      ret = validatorFunction?.(data)
+    }
   } catch (err) {
     // If validator throws synchronously, ensure it propagates as an internal error
     err.statusCode = 500

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastify",
-  "version": "5.11.3",
+  "version": "5.12.1",
   "description": "Fast and low overhead web framework, for Node.js",
   "main": "fastify.js",
   "type": "commonjs",
@@ -167,7 +167,6 @@
   ],
   "devDependencies": {
     "@jsumners/line-reporter": "^1.0.1",
-    "@sinonjs/fake-timers": "^11.2.2",
     "@stylistic/eslint-plugin": "^5.1.0",
     "@stylistic/eslint-plugin-js": "^4.1.0",
     "@types/node": "^26.0.1",
@@ -214,7 +213,7 @@
     "find-my-way": "^9.6.0",
     "light-my-request": "^6.0.0",
     "pino": "^9.14.0 || ^10.1.0",
-    "process-warning": "^5.0.0",
+    "process-warning": "^5.1.0",
     "rfdc": "^1.3.1",
     "secure-json-parse": "^4.0.0",
     "semver": "^7.6.0",

package/test/close.test.js

@@ -665,6 +665,40 @@ test('preClose async', async t => {
   await fastify.close()
 })
 
+test('preClose runs exactly once with a child plugin', async t => {
+  t.plan(1)
+  const fastify = Fastify()
+  let count = 0
+
+  fastify.register(async (child) => {
+    child.get('/x', async () => 'ok')
+  })
+  fastify.addHook('preClose', async () => { count++ })
+
+  await fastify.ready()
+  await fastify.close()
+
+  t.assert.strictEqual(count, 1)
+})
+
+test('preClose runs exactly once with nested child plugins', async t => {
+  t.plan(1)
+  const fastify = Fastify()
+  let count = 0
+
+  fastify.register(async (child) => {
+    child.register(async (grandchild) => {
+      grandchild.get('/y', async () => 'ok')
+    })
+  })
+  fastify.addHook('preClose', async () => { count++ })
+
+  await fastify.ready()
+  await fastify.close()
+
+  t.assert.strictEqual(count, 1)
+})
+
 test('preClose execution order', (t, done) => {
   t.plan(4)
   const fastify = Fastify()

package/test/content-parser.test.js

@@ -1,9 +1,11 @@
 'use strict'
 
 const { test } = require('node:test')
+const { spyWarning } = require('process-warning')
 const Fastify = require('..')
 const keys = require('../lib/symbols')
 const { FST_ERR_CTP_ALREADY_PRESENT, FST_ERR_CTP_INVALID_TYPE, FST_ERR_CTP_INVALID_MEDIA_TYPE } = require('../lib/errors')
+const { FSTSEC001 } = require('../lib/warnings')
 
 const first = function (req, payload, done) {}
 const second = function (req, payload, done) {}
@@ -488,41 +490,37 @@ test('Safeguard against content-type spoofing - string', async t => {
 })
 
 test('Warning against improper content-type - regexp', async t => {
-  await t.test('improper regex - text plain', (t, done) => {
+  await t.test('improper regex - text plain', async (t) => {
     t.plan(2)
-    const fastify = Fastify()
+    const spyData = spyWarning(FSTSEC001)
+    t.after(spyData.restore)
 
-    process.on('warning', onWarning)
-    function onWarning (warning) {
-      t.assert.strictEqual(warning.name, 'FastifySecurity')
-      t.assert.strictEqual(warning.code, 'FSTSEC001')
-      done()
-    }
-    t.after(() => process.removeListener('warning', onWarning))
+    const fastify = Fastify()
 
     fastify.removeAllContentTypeParsers()
     fastify.addContentTypeParser(/text\/plain/, function (request, body, done) {
       done(null, body)
     })
+
+    await fastify.ready()
+    t.assert.deepStrictEqual(spyData.calls, [{ arguments: ['text\\/plain'], result: true }])
+    t.assert.strictEqual(spyData.callCount(), 1)
   })
 
-  await t.test('improper regex - application json', (t, done) => {
+  await t.test('improper regex - application json', async (t) => {
     t.plan(2)
+    const spyData = spyWarning(FSTSEC001)
+    t.after(spyData.restore)
     const fastify = Fastify()
 
-    process.on('warning', onWarning)
-    function onWarning (warning) {
-      t.assert.strictEqual(warning.name, 'FastifySecurity')
-      t.assert.strictEqual(warning.code, 'FSTSEC001')
-      done()
-    }
-    t.after(() => process.removeListener('warning', onWarning))
-
     fastify.removeAllContentTypeParsers()
 
     fastify.addContentTypeParser(/application\/json/, function (request, body, done) {
       done(null, body)
     })
+
+    t.assert.deepStrictEqual(spyData.calls, [{ arguments: ['application\\/json'], result: true }])
+    t.assert.deepEqual(spyData.callCount(), 1)
   })
 })
 

package/test/content-type.test.js

@@ -46,18 +46,22 @@ describe('ContentType class', () => {
   test('returns empty instance for empty value', (t) => {
     let found = new ContentType('')
     t.assert.equal(found.isEmpty, true)
+    t.assert.equal(found.mediaType, undefined)
 
     found = new ContentType('undefined')
     t.assert.equal(found.isEmpty, true)
+    t.assert.equal(found.mediaType, undefined)
 
     found = new ContentType()
     t.assert.equal(found.isEmpty, true)
+    t.assert.equal(found.mediaType, undefined)
   })
 
   test('indicates media type is not correct format', (t) => {
     let found = new ContentType('foo')
     t.assert.equal(found.isEmpty, true)
     t.assert.equal(found.isValid, false)
+    t.assert.equal(found.mediaType, undefined)
 
     found = new ContentType('foo /bar')
     t.assert.equal(found.isEmpty, true)

package/test/fix-root-primitive-coercion.test.js

@@ -0,0 +1,35 @@
+'use strict'
+
+const { test } = require('node:test')
+const Fastify = require('..')
+
+test('root primitive values coerced by Ajv are assigned to the request', async (t) => {
+  const fastify = Fastify()
+
+  fastify.post('/', {
+    schema: {
+      body: {
+        type: 'integer',
+        minimum: 1,
+        maximum: 10
+      }
+    }
+  }, (request, reply) => {
+    reply.send({ body: request.body, type: typeof request.body })
+  })
+
+  const response = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    payload: '"10"',
+    headers: { 'content-type': 'application/json' }
+  })
+
+  t.assert.strictEqual(response.statusCode, 200)
+  t.assert.deepStrictEqual(JSON.parse(response.payload), {
+    body: 10,
+    type: 'number'
+  })
+
+  await fastify.close()
+})

package/test/helper.js

@@ -4,11 +4,42 @@ const dns = require('node:dns').promises
 const stream = require('node:stream')
 const { promisify } = require('node:util')
 const symbols = require('../lib/symbols')
-const { waitForCb } = require('./toolkit')
 const assert = require('node:assert')
 
 module.exports.sleep = promisify(setTimeout)
 
+function waitForCb (options) {
+  let count = null
+  let done = false
+  let iResolve
+  let iReject
+
+  function stepIn () {
+    if (done) {
+      iReject(new Error('Unexpected done call'))
+      return
+    }
+
+    if (--count) {
+      return
+    }
+
+    done = true
+    iResolve()
+  }
+
+  const patience = new Promise((resolve, reject) => {
+    iResolve = resolve
+    iReject = reject
+  })
+
+  count = options.steps || 1
+  done = false
+
+  return { stepIn, patience }
+}
+module.exports.waitForCb = waitForCb
+
 /**
  * @param method HTTP request method
  * @param t node:test instance
@@ -494,3 +525,44 @@ module.exports.getServerUrl = function (app) {
     ? `http://[${address}]:${port}`
     : `http://${address}:${port}`
 }
+
+module.exports.partialDeepStrictEqual = function partialDeepStrictEqual (actual, expected) {
+  if (typeof expected !== 'object' || expected === null) {
+    return actual === expected
+  }
+
+  if (typeof actual !== 'object' || actual === null) {
+    return false
+  }
+
+  if (Array.isArray(expected)) {
+    if (!Array.isArray(actual)) return false
+    if (expected.length > actual.length) return false
+
+    for (let i = 0; i < expected.length; i++) {
+      if (!partialDeepStrictEqual(actual[i], expected[i])) {
+        return false
+      }
+    }
+    return true
+  }
+
+  for (const key of Object.keys(expected)) {
+    if (!(key in actual)) return false
+    if (!partialDeepStrictEqual(actual[key], expected[key])) {
+      return false
+    }
+  }
+
+  return true
+}
+
+module.exports.assertNoWarning = function (t) {
+  function doNotWarn () {
+    t.assert.fail('no warning')
+  }
+  process.on('warning', doNotWarn)
+  t.after(() => {
+    process.off('warning', doNotWarn)
+  })
+}

package/test/hooks-async.test.js

@@ -4,8 +4,7 @@ const { Readable } = require('node:stream')
 const { test, describe } = require('node:test')
 const Fastify = require('../fastify')
 const fs = require('node:fs')
-const { sleep } = require('./helper')
-const { waitForCb } = require('./toolkit')
+const { sleep, waitForCb } = require('./helper')
 
 process.removeAllListeners('warning')
 

package/test/hooks.test.js

@@ -10,8 +10,7 @@ const symbols = require('../lib/symbols.js')
 const payload = { hello: 'world' }
 const proxyquire = require('proxyquire')
 const { connect } = require('node:net')
-const { sleep } = require('./helper')
-const { waitForCb } = require('./toolkit.js')
+const { sleep, waitForCb } = require('./helper')
 const { fetch } = require('undici')
 
 process.removeAllListeners('warning')

package/test/internals/reply.test.js

@@ -34,7 +34,7 @@ const doGet = async function (url) {
 }
 
 test('Once called, Reply should return an object with methods', t => {
-  t.plan(15)
+  t.plan(16)
   const response = { res: 'res' }
   const context = {
     config: { onSend: [] },
@@ -49,6 +49,7 @@ test('Once called, Reply should return an object with methods', t => {
   t.assert.strictEqual(typeof reply[kReplyErrorHandlerCalled], 'boolean')
   t.assert.strictEqual(typeof reply.send, 'function')
   t.assert.strictEqual(typeof reply.code, 'function')
+  t.assert.strictEqual(typeof reply.mediaType, 'undefined')
   t.assert.strictEqual(typeof reply.status, 'function')
   t.assert.strictEqual(typeof reply.header, 'function')
   t.assert.strictEqual(typeof reply.serialize, 'function')
@@ -1114,6 +1115,80 @@ test('reply.removeHeader can remove the value', async t => {
   await fetch(`${fastifyServer}/headers`)
 })
 
+test('reply.removeHeader removes raw headers', async t => {
+  t.plan(9)
+
+  const fastify = require('../../')()
+
+  t.after(() => fastify.close())
+
+  fastify.get('/headers', function (req, reply) {
+    reply.raw.setHeader('X-Foo', 'raw')
+    t.assert.strictEqual(reply.getHeader('x-foo'), 'raw')
+    t.assert.strictEqual(reply.getHeaders()['x-foo'], 'raw')
+    t.assert.strictEqual(reply.hasHeader('x-foo'), true)
+
+    t.assert.strictEqual(reply.removeHeader('x-FoO'), reply)
+    t.assert.strictEqual(reply.getHeader('x-foo'), undefined)
+    t.assert.strictEqual(Object.hasOwn(reply.getHeaders(), 'x-foo'), false)
+    t.assert.strictEqual(reply.hasHeader('x-foo'), false)
+    t.assert.strictEqual(reply.removeHeader('X-FOO'), reply)
+
+    reply.send()
+  })
+
+  const fastifyServer = await fastify.listen({ port: 0 })
+  const response = await fetch(`${fastifyServer}/headers`)
+  t.assert.strictEqual(response.headers.get('x-foo'), null)
+})
+
+test('reply.removeHeader removes layered headers', async t => {
+  t.plan(7)
+
+  const fastify = require('../../')()
+
+  t.after(() => fastify.close())
+
+  fastify.get('/headers', function (req, reply) {
+    reply.raw.setHeader('x-foo', 'raw')
+    reply.header('x-foo', 'fastify')
+    t.assert.strictEqual(reply.getHeader('x-foo'), 'fastify')
+    t.assert.strictEqual(reply.getHeaders()['x-foo'], 'fastify')
+
+    t.assert.strictEqual(reply.removeHeader('x-foo'), reply)
+    t.assert.strictEqual(reply.getHeader('x-foo'), undefined)
+    t.assert.strictEqual(Object.hasOwn(reply.getHeaders(), 'x-foo'), false)
+    t.assert.strictEqual(reply.hasHeader('x-foo'), false)
+
+    reply.send()
+  })
+
+  const fastifyServer = await fastify.listen({ port: 0 })
+  const response = await fetch(`${fastifyServer}/headers`)
+  t.assert.strictEqual(response.headers.get('x-foo'), null)
+})
+
+test('reply.removeHeader does not throw after headers are sent', async t => {
+  t.plan(3)
+
+  const fastify = require('../../')()
+
+  t.after(() => fastify.close())
+
+  fastify.get('/headers', function (req, reply) {
+    reply.hijack()
+    reply.raw.setHeader('x-foo', 'raw')
+    reply.raw.flushHeaders()
+    t.assert.strictEqual(reply.raw.headersSent, true)
+    t.assert.doesNotThrow(() => reply.removeHeader('x-foo'))
+    reply.raw.end()
+  })
+
+  const fastifyServer = await fastify.listen({ port: 0 })
+  const response = await fetch(`${fastifyServer}/headers`)
+  t.assert.strictEqual(response.headers.get('x-foo'), 'raw')
+})
+
 test('reply.header can reset the value', async t => {
   t.plan(1)
 

package/test/listen.1.test.js

@@ -4,6 +4,7 @@ const { networkInterfaces } = require('node:os')
 const { test, before } = require('node:test')
 const Fastify = require('..')
 const helper = require('./helper')
+const { assertNoWarning } = require('./helper')
 
 let localhost
 let localhostForURL
@@ -13,33 +14,22 @@ before(async function () {
 })
 
 test('listen works without arguments', async t => {
-  const doNotWarn = () => {
-    t.assert.fail('should not be deprecated')
-  }
-  process.on('warning', doNotWarn)
+  assertNoWarning(t)
 
   const fastify = Fastify()
-  t.after(() => {
-    fastify.close()
-    process.removeListener('warning', doNotWarn)
-  })
+
   await fastify.listen()
   const address = fastify.server.address()
   t.assert.strictEqual(address.address, localhost)
   t.assert.ok(address.port > 0)
+  await fastify.close()
 })
 
 test('Async/await listen with arguments', async t => {
-  const doNotWarn = () => {
-    t.assert.fail('should not be deprecated')
-  }
-  process.on('warning', doNotWarn)
+  assertNoWarning(t)
 
   const fastify = Fastify()
-  t.after(() => {
-    fastify.close()
-    process.removeListener('warning', doNotWarn)
-  })
+
   const addr = await fastify.listen({ port: 0, host: '0.0.0.0' })
   const address = fastify.server.address()
   const { protocol, hostname, port, pathname } = new URL(addr)
@@ -55,39 +45,27 @@ test('Async/await listen with arguments', async t => {
     family: 'IPv4',
     port: address.port
   })
+  await fastify.close()
 })
 
 test('listen accepts a callback', (t, done) => {
   t.plan(2)
-  const doNotWarn = () => {
-    t.assert.fail('should not be deprecated')
-  }
-  process.on('warning', doNotWarn)
+  assertNoWarning(t)
 
   const fastify = Fastify()
-  t.after(() => {
-    fastify.close()
-    process.removeListener('warning', doNotWarn)
-  })
+
   fastify.listen({ port: 0 }, (err) => {
     t.assert.ifError(err)
     t.assert.strictEqual(fastify.server.address().address, localhost)
-    done()
+    fastify.close(done)
   })
 })
 
 test('listen accepts options and a callback', (t, done) => {
   t.plan(1)
-  const doNotWarn = () => {
-    t.assert.fail('should not be deprecated')
-  }
-  process.on('warning', doNotWarn)
+  assertNoWarning(t)
 
   const fastify = Fastify()
-  t.after(() => {
-    fastify.close()
-    process.removeListener('warning', doNotWarn)
-  })
   fastify.listen({
     port: 0,
     host: 'localhost',
@@ -98,7 +76,7 @@ test('listen accepts options and a callback', (t, done) => {
     ipv6Only: false
   }, (err) => {
     t.assert.ifError(err)
-    done()
+    fastify.close(done)
   })
 })
 
@@ -118,37 +96,24 @@ test('listen after Promise.resolve()', (t, done) => {
 })
 
 test('listen works with undefined host', async t => {
-  const doNotWarn = () => {
-    t.assert.fail('should not be deprecated')
-  }
-  process.on('warning', doNotWarn)
+  assertNoWarning(t)
 
   const fastify = Fastify()
-  t.after(() => fastify.close())
-  t.after(() => {
-    fastify.close()
-    process.removeListener('warning', doNotWarn)
-  })
   await fastify.listen({ host: undefined, port: 0 })
   const address = fastify.server.address()
   t.assert.strictEqual(address.address, localhost)
   t.assert.ok(address.port > 0)
+  await fastify.close()
 })
 
 test('listen works with null host', async t => {
-  const doNotWarn = () => {
-    t.fail('should not be deprecated')
-  }
-  process.on('warning', doNotWarn)
+  assertNoWarning(t)
 
   const fastify = Fastify()
-  t.after(() => fastify.close())
-  t.after(() => {
-    fastify.close()
-    process.removeListener('warning', doNotWarn)
-  })
+
   await fastify.listen({ host: null, port: 0 })
   const address = fastify.server.address()
   t.assert.strictEqual(address.address, localhost)
   t.assert.ok(address.port > 0)
+  await fastify.close()
 })