fastify 5.12.4 → 5.12.6

package/docs/Reference/Errors.md

@@ -445,7 +445,7 @@ Below is a table with all the error codes used by Fastify.
 | <a id="fst_err_route_handler_timeout_option_not_int">FST_ERR_ROUTE_HANDLER_TIMEOUT_OPTION_NOT_INT</a> | `handlerTimeout` option must be a positive integer. | Use a positive integer for the `handlerTimeout` option. | - |
 | <a id="fst_err_route_rewrite_not_str">FST_ERR_ROUTE_REWRITE_NOT_STR</a> | `rewriteUrl` needs to be of type `string`. | Use a string for the `rewriteUrl`. | [#4554](https://github.com/fastify/fastify/pull/4554) |
 | <a id="fst_err_route_missing_content_type">FST_ERR_ROUTE_MISSING_CONTENT_TYPE</a> | `Content-Type` header is required for the request. | Send request with `Content-Type` header. | [#6832](https://github.com/fastify/fastify/pull/6832) |
-| <a id="fst_err_route_missing_content">FST_ERR_ROUTE_MISSING_CONTENT</a> | Body is required for the request. | Send request with payload. | [#6832](https://github.com/fastify/fastify/pull/6832) |
+| <a id="fst_err_route_missing_content">FST_ERR_ROUTE_MISSING_CONTENT</a> | Body is required for the request. No longer thrown, will be removed in v6. | - | [#6832](https://github.com/fastify/fastify/pull/6832) |
 | <a id="fst_err_reopened_close_server">FST_ERR_REOPENED_CLOSE_SERVER</a> | Fastify has already been closed and cannot be reopened. | - | [#2415](https://github.com/fastify/fastify/pull/2415) |
 | <a id="fst_err_reopened_server">FST_ERR_REOPENED_SERVER</a> | Fastify is already listening. | - | [#2415](https://github.com/fastify/fastify/pull/2415) |
 | <a id="fst_err_plugin_version_mismatch">FST_ERR_PLUGIN_VERSION_MISMATCH</a> | Installed Fastify plugin mismatched expected version. | Use a compatible version of the plugin. | [#2549](https://github.com/fastify/fastify/pull/2549) |

package/docs/Reference/Reply.md

@@ -277,8 +277,9 @@ requires heavy resources to be sent after the `data`, for example,
 as soon as possible.
 
 > ℹ️ Note:
-> The header `Transfer-Encoding: chunked` will be added once you use
-> the trailer. It is a hard requirement for using trailer in Node.js.
+> For HTTP/1 responses, the header `Transfer-Encoding: chunked` will be added
+> once you use a trailer. HTTP/2 does not use chunked transfer encoding and
+> sends trailers using its native trailing headers support.
 
 > ℹ️ Note:
 > Any error passed to `done` callback will be ignored. If you are interested

package/docs/Reference/Routes.md

@@ -32,7 +32,7 @@ fastify.route(options)
 <a id="options"></a>
 
 * `method`: currently it supports `GET`, `HEAD`, `TRACE`, `DELETE`,
-  `OPTIONS`, `PATCH`, `PUT` and `POST`. To accept more methods,
+  `OPTIONS`, `PATCH`, `PUT`, `POST` and `QUERY`. To accept more methods,
   the [`addHttpMethod`](./Server.md#addHttpMethod) must be used.
   It could also be an array of methods.
 * `url`: the path of the URL to match this route (alias: `path`).
@@ -41,7 +41,7 @@ fastify.route(options)
   [here](./Validation-and-Serialization.md) for more info.
 
   * `body`: validates the body of the request if it is a POST, PUT, PATCH,
-    TRACE, SEARCH, PROPFIND, PROPPATCH or LOCK method.
+    TRACE, SEARCH, PROPFIND, PROPPATCH, LOCK or QUERY method.
   * `querystring` or `query`: validates the querystring. This can be a complete
     JSON Schema object, with the property `type` of `object` and `properties`
     object of parameters, or simply the values of what would be contained in the
@@ -198,6 +198,10 @@ The above route declaration is more *Hapi*-like, but if you prefer an
 
 `fastify.patch(path, [options], handler)`
 
+`fastify.query(path, [options], handler)`
+
+> The `QUERY` method (RFC 10008) requires a `Content-Type` header.
+
 Example:
 ```js
 const opts = {

package/docs/Reference/Validation-and-Serialization.md

@@ -167,6 +167,22 @@ parameters at the top level.
 > ℹ For using the latest Ajv (v8), refer to the
 > [`schemaController`](./Server.md#schema-controller) section.
 
+##### Header name case
+
+Node.js exposes request header names in lowercase. Fastify normalizes header
+names in a `headers` schema to lowercase before compilation, so assertions
+written in the canonical header-name case still match the request, for example
+`required: ['X-Api-Key']`, `dependencies`, and a `propertyNames` deny-list that
+uses `enum` or `const`.
+
+Regular-expression constraints on header names are the exception. A
+`patternProperties` key and a `propertyNames` `pattern` are regular expressions
+matched against the already-lowercased header names, and Fastify cannot safely
+rewrite a regular expression. Author them to match lowercase (for example
+`^x-debug-.*$`, not `^X-Debug-.*$`) or make them case-insensitive. A pattern
+written in canonical case will not match, and the assertion it guards will not
+apply.
+
 Example:
 ```js
 const bodyJsonSchema = {

package/docs/Reference/Warnings.md

@@ -11,6 +11,7 @@
   - [Fastify Security Codes](#fastify-security-codes)
     - [FSTSEC001](#FSTSEC001)
     - [FSTSEC002](#FSTSEC002)
+    - [FSTSEC003](#FSTSEC003)
   - [Fastify Deprecation Codes](#fastify-deprecation-codes)
     - [FSTDEP022](#FSTDEP022)
     - [FSTDEP023](#FSTDEP023)
@@ -57,6 +58,7 @@ Disabling warnings is not recommended and may cause unexpected behavior.
 | ---- | ----------- | ------------ | ---------- |
 | <a id="FSTSEC001">FSTSEC001</a> | A `RegExp` Content-Type is used that may be vulnerable to a CORS bypass, because it does not anchor the essence MIME type. | Start the `RegExp` with `^` or include `;?` so the essence MIME type is detected correctly. | [#4450](https://github.com/fastify/fastify/pull/4450) |
 | <a id="FSTSEC002">FSTSEC002</a> | A headers schema references an external `$ref` (a schema registered with `addSchema`) that is not reached by header case normalization. Header names in the referenced schema keep their original case and do not match the lowercased request headers, so case-insensitive assertions such as `required` and `dependencies` may not apply. | Inline the header schema instead of referencing it with an external `$ref`. | - |
+| <a id="FSTSEC003">FSTSEC003</a> | A headers schema uses a `$ref` inside `propertyNames` that is not reached by header case normalization. Header names held in the referenced schema keep their original case and do not match the lowercased request headers, so a case-insensitive deny-list or allow-list on header names may not apply. | Inline the `propertyNames` constraint instead of referencing it with a `$ref`. | - |
 
 ### Fastify Deprecation Codes
 

package/fastify.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const VERSION = '5.12.4'
+const VERSION = '5.12.5'
 
 const Avvio = require('avvio')
 const http = require('node:http')

package/lib/content-type-parser.js

@@ -140,6 +140,7 @@ ContentTypeParser.prototype.getParser = function (contentType) {
   // with that type.
   parser = this.customParsers.get(contentType.mediaType)
   if (parser !== undefined) {
+    this.cache.set(ct, parser)
     return parser
   }
 
@@ -203,7 +204,12 @@ ContentTypeParser.prototype.run = function (contentType, handler, request, reply
   }
 
   const resource = new AsyncResource('content-type-parser:run', request)
-  const done = resource.bind(onDone)
+
+  // Preserve the request's async context without the per-request function
+  // properties and wrappers created by AsyncResource.bind().
+  function done (error, body) {
+    resource.runInAsyncScope(onDone, undefined, error, body)
+  }
 
   if (parser.asString === true || parser.asBuffer === true) {
     rawBody(
@@ -247,12 +253,12 @@ function rawBody (request, reply, options, parser, done) {
   }
 
   let receivedLength = 0
-  let body = asString ? '' : []
+  const chunks = []
   const payload = request[kRequestPayloadStream] || request.raw
 
-  if (asString) {
-    payload.setEncoding('utf8')
-  }
+  // Always read raw Buffers and decode once at the end: setEncoding() would
+  // allocate a StringDecoder per request and force a Buffer.byteLength()
+  // rescan of every decoded chunk just to enforce the byte limit.
 
   payload.on('data', onData)
   payload.on('end', onEnd)
@@ -260,7 +266,11 @@ function rawBody (request, reply, options, parser, done) {
   payload.resume()
 
   function onData (chunk) {
-    receivedLength += asString ? Buffer.byteLength(chunk) : chunk.length
+    // A custom preParsing stream may still emit strings
+    if (typeof chunk === 'string') {
+      chunk = Buffer.from(chunk)
+    }
+    receivedLength += chunk.length
     const { receivedEncodedLength = 0 } = payload
     // The resulting body length must not exceed bodyLimit (see "zip bomb").
     // The case when encoded length is larger than received length is rather theoretical,
@@ -273,11 +283,7 @@ function rawBody (request, reply, options, parser, done) {
       return
     }
 
-    if (asString) {
-      body += chunk
-    } else {
-      body.push(chunk)
-    }
+    chunks.push(chunk)
   }
 
   function onEnd (err) {
@@ -298,8 +304,17 @@ function rawBody (request, reply, options, parser, done) {
       return
     }
 
-    if (!asString) {
-      body = Buffer.concat(body)
+    let body
+    if (asString) {
+      // Decoding the whole body at once also keeps multi-byte characters
+      // split across chunks intact
+      body = chunks.length === 1
+        ? chunks[0].toString('utf8')
+        : Buffer.concat(chunks, receivedLength).toString('utf8')
+    } else {
+      // Always copy so the parser never receives a view over the shared
+      // socket read buffer
+      body = Buffer.concat(chunks, receivedLength)
     }
 
     const result = parser.fn(request, body, done)

package/lib/content-type.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const { LruMap: Lru } = require('toad-cache')
+const { FifoMap: Fifo } = require('toad-cache')
 
 /**
  * keyValuePairsReg matches a single `parameter-name "=" parameter-value`
@@ -61,9 +61,9 @@ const subtypeNameReg = /^[\w!#$%&'*+.^`|~-]+\s*$/
 
 /**
  * Content-Type internal shared cache
- * @type {Lru<ContentType>}
+ * @type {Fifo<ContentType>}
  */
-const cache = new Lru(100)
+const cache = new Fifo(100)
 
 /**
  * ContentType parses and represents the value of the content-type header.
@@ -82,7 +82,7 @@ class ContentType {
   /**
    * The shared cache of ContentType instances. The cache is used to avoid
    * creating multiple instances of ContentType for the same header value.
-   * @type {Lru<ContentType>}
+   * @type {Fifo<ContentType>}
    */
   static get cache () { return cache }
 

package/lib/errors.js

@@ -460,6 +460,7 @@ const codes = {
     "Method '%s' must provide a 'Content-Type' header.",
     400
   ),
+  // No longer thrown, kept exported until v6 to avoid a breaking change
   FST_ERR_ROUTE_MISSING_CONTENT: createError(
     'FST_ERR_ROUTE_MISSING_CONTENT',
     "Method '%s' must provide a request body.",

package/lib/handle-request.js

@@ -6,8 +6,7 @@ const { validate: validateSchema } = require('./validation')
 const { preValidationHookRunner, preHandlerHookRunner } = require('./hooks')
 const {
   FST_ERR_CTP_INVALID_MEDIA_TYPE,
-  FST_ERR_ROUTE_MISSING_CONTENT_TYPE,
-  FST_ERR_ROUTE_MISSING_CONTENT
+  FST_ERR_ROUTE_MISSING_CONTENT_TYPE
 } = require('./errors')
 const { setErrorStatusCode } = require('./error-status')
 const {
@@ -51,20 +50,15 @@ function handleRequest (err, request, reply) {
         reply.status(400).send(new FST_ERR_ROUTE_MISSING_CONTENT_TYPE(method))
         return
       }
-
-      if (isEmptyBody(headers)) {
-        // https://datatracker.ietf.org/doc/html/rfc10008#section-2
-        // Servers MUST fail the request if the Content-Type request field
-        // ([HTTP], Section 8.3) is missing or is inconsistent with the
-        // request content.
-        reply[kReplyIsError] = true
-        reply.status(400).send(new FST_ERR_ROUTE_MISSING_CONTENT(method))
-        return
-      }
     }
 
     if (ctHeader === undefined) {
-      if (isEmptyBody(headers)) {
+      const contentLength = headers['content-length']
+      const transferEncoding = headers['transfer-encoding']
+      const isEmptyBody = transferEncoding === undefined &&
+        (contentLength === undefined || contentLength === '0')
+
+      if (isEmptyBody) {
         // Request has no body to parse
         handler(request, reply)
         return
@@ -109,13 +103,6 @@ function handler (request, reply) {
   }
 }
 
-function isEmptyBody (headers) {
-  const contentLength = headers['content-length']
-  const transferEncoding = headers['transfer-encoding']
-  return transferEncoding === undefined &&
-    (contentLength === undefined || contentLength === '0')
-}
-
 function preValidationCallback (err, request, reply) {
   if (reply.sent === true) return
 

package/lib/reply.js

@@ -95,7 +95,7 @@ Object.defineProperties(Reply.prototype, {
   },
   mediaType: {
     get () {
-      const contentTypeHeader = this[kReplyHeaders]['content-type']
+      const contentTypeHeader = this.getHeader('content-type')
       return ContentType.from(contentTypeHeader).mediaType
     }
   },
@@ -284,6 +284,10 @@ Reply.prototype.header = function (key, value = '') {
     } else {
       this[kReplyHeaders][key].push(value)
     }
+  } else if (key === 'set-cookie' && Array.isArray(value)) {
+    // Copy the array: later calls push into the stored one, and the caller's
+    // array (often a module-level constant) must not grow across requests.
+    this[kReplyHeaders][key] = value.slice()
   } else {
     this[kReplyHeaders][key] = value
   }
@@ -606,8 +610,11 @@ function onSendEnd (reply, payload) {
       header += trailerName
     }
     if (header !== '') {
-      // it must be chunked for trailer to work
-      reply.header('Transfer-Encoding', 'chunked')
+      // HTTP/1 must use chunked encoding for trailers. HTTP/2 forbids
+      // the transfer-encoding header and handles trailers natively.
+      if (!isHttp2Reply(reply)) {
+        reply.header('Transfer-Encoding', 'chunked')
+      }
       reply.header('Trailer', header.trim())
     } else {
       reply[kReplyTrailers] = null

package/lib/route.js

@@ -467,8 +467,12 @@ function buildRouting (options) {
       // the child logger creation altogether
       childLogger = logger
     } else {
-      const loggerOpts = {
-        level: context.logLevel
+      const loggerOpts = {}
+
+      // An empty level means "inherit". Passing it would make pino treat it
+      // as a level change and rebuild every log method of each request child.
+      if (context.logLevel) {
+        loggerOpts.level = context.logLevel
       }
 
       if (context.logSerializers) {

package/lib/validation.js

@@ -13,7 +13,7 @@ const {
   FST_ERR_SCH_RESPONSE_SCHEMA_NOT_NESTED_2XX
 } = require('./errors')
 
-const { FSTWRN001, FSTSEC002 } = require('./warnings')
+const { FSTWRN001, FSTSEC002, FSTSEC003 } = require('./warnings')
 
 function compileSchemasForSerialization (context, compile) {
   if (!context.schema || !context.schema.response) {
@@ -70,9 +70,14 @@ function compileSchemasForSerialization (context, compile) {
 // reachable through `allOf`, `anyOf`, `oneOf`, `not`, `if`/`then`/`else`, local
 // `$ref` definitions (`definitions`/`$defs`), and the other standard subschema
 // containers. The input schema is never mutated: a new schema tree is returned.
-function lowerCaseHeadersSchema (schema) {
+//
+// A `propertyNames` subschema validates each header name itself, so values held
+// in `enum` and `const` (and in every subschema reachable from it) are header
+// names rather than header values. `insidePropertyNames` tracks that context so
+// those `enum`/`const` string values are lowercased there, and only there.
+function lowerCaseHeadersSchema (schema, insidePropertyNames = false) {
   if (Array.isArray(schema)) {
-    return schema.map(lowerCaseHeadersSchema)
+    return schema.map(item => lowerCaseHeadersSchema(item, insidePropertyNames))
   }
   if (schema === null || typeof schema !== 'object') {
     return schema
@@ -91,7 +96,7 @@ function lowerCaseHeadersSchema (schema) {
         }
         const normalized = {}
         for (const prop of Object.keys(value)) {
-          normalized[prop.toLowerCase()] = lowerCaseHeadersSchema(value[prop])
+          normalized[prop.toLowerCase()] = lowerCaseHeadersSchema(value[prop], insidePropertyNames)
         }
         result.properties = normalized
         break
@@ -112,7 +117,7 @@ function lowerCaseHeadersSchema (schema) {
           if (Array.isArray(depValue)) {
             normalized[dep.toLowerCase()] = depValue.map(name => name.toLowerCase())
           } else {
-            normalized[dep.toLowerCase()] = lowerCaseHeadersSchema(depValue)
+            normalized[dep.toLowerCase()] = lowerCaseHeadersSchema(depValue, insidePropertyNames)
           }
         }
         result.dependencies = normalized
@@ -125,7 +130,7 @@ function lowerCaseHeadersSchema (schema) {
         }
         const normalized = {}
         for (const dep of Object.keys(value)) {
-          normalized[dep.toLowerCase()] = lowerCaseHeadersSchema(value[dep])
+          normalized[dep.toLowerCase()] = lowerCaseHeadersSchema(value[dep], insidePropertyNames)
         }
         result.dependentSchemas = normalized
         break
@@ -158,12 +163,21 @@ function lowerCaseHeadersSchema (schema) {
       case 'unevaluatedItems':
       case 'unevaluatedProperties':
       case 'contains':
-      case 'propertyNames':
       case 'contentSchema':
-        result[key] = lowerCaseHeadersSchema(value)
+        result[key] = lowerCaseHeadersSchema(value, insidePropertyNames)
+        break
+      case 'propertyNames':
+        result[key] = lowerCaseHeadersSchema(value, true)
         break
       // Maps of subschemas whose keys are not header names (definition names,
       // regex patterns): keep the keys, normalize the subschema values.
+      //
+      // `patternProperties` keys are regular expressions matched against the
+      // already-lowercased header names and are left as-is: a regular expression
+      // cannot be safely lowercased. The same applies to a `propertyNames`
+      // `pattern`. A header-name pattern written in canonical case will not match
+      // the lowercased request headers, so it must be authored to match
+      // lowercase. See docs/Reference/Validation-and-Serialization.md.
       case 'definitions':
       case '$defs':
       case 'patternProperties': {
@@ -173,13 +187,23 @@ function lowerCaseHeadersSchema (schema) {
         }
         const normalized = {}
         for (const k of Object.keys(value)) {
-          normalized[k] = lowerCaseHeadersSchema(value[k])
+          normalized[k] = lowerCaseHeadersSchema(value[k], insidePropertyNames)
         }
         result[key] = normalized
         break
       }
       default:
-        result[key] = value
+        // Inside a `propertyNames` subschema, `enum` and `const` values are the
+        // candidate header names themselves, so they must be lowercased to match
+        // the lowercased request headers. Everywhere else these hold header
+        // *values* (or arbitrary constant data) and must be left untouched.
+        if (insidePropertyNames && key === 'enum' && Array.isArray(value)) {
+          result[key] = value.map(item => typeof item === 'string' ? item.toLowerCase() : item)
+        } else if (insidePropertyNames && key === 'const' && typeof value === 'string') {
+          result[key] = value.toLowerCase()
+        } else {
+          result[key] = value
+        }
     }
   }
 
@@ -217,6 +241,35 @@ function findExternalHeaderRef (schema) {
   return undefined
 }
 
+// A `$ref` reached inside a `propertyNames` subschema resolves to a definition
+// that is normalized in its own, non-`propertyNames` context, so header names
+// held in its `enum`/`const` keep their original case and a case-insensitive
+// deny-list or allow-list never matches the lowercased request headers. We
+// cannot safely normalize the referenced definition here because it may be
+// shared with value contexts, so we detect the reference and warn instead.
+// Returns the first local `$ref` found inside a `propertyNames` subschema, or
+// undefined.
+function findPropertyNamesRef (schema, insidePropertyNames = false) {
+  if (Array.isArray(schema)) {
+    for (const item of schema) {
+      const ref = findPropertyNamesRef(item, insidePropertyNames)
+      if (ref !== undefined) return ref
+    }
+    return undefined
+  }
+  if (schema === null || typeof schema !== 'object') {
+    return undefined
+  }
+  if (insidePropertyNames && typeof schema.$ref === 'string' && schema.$ref[0] === '#') {
+    return schema.$ref
+  }
+  for (const key of Object.keys(schema)) {
+    const ref = findPropertyNamesRef(schema[key], insidePropertyNames || key === 'propertyNames')
+    if (ref !== undefined) return ref
+  }
+  return undefined
+}
+
 function compileSchemasForValidation (context, compile, isCustom) {
   const { schema } = context
   if (!schema) {
@@ -246,6 +299,10 @@ function compileSchemasForValidation (context, compile, isCustom) {
       if (externalRef !== undefined) {
         FSTSEC002(method, url, externalRef)
       }
+      const propertyNamesRef = findPropertyNamesRef(headers)
+      if (propertyNamesRef !== undefined) {
+        FSTSEC003(method, url, propertyNamesRef)
+      }
       context[headersSchema] = compile({ schema: headersSchemaLowerCase, method, url, httpPart: 'headers' })
     }
   } else if (Object.hasOwn(schema, 'headers')) {
@@ -284,19 +341,21 @@ function compileSchemasForValidation (context, compile, isCustom) {
 }
 
 function validateParam (validatorFunction, request, paramName) {
-  const isUndefined = request[paramName] === undefined
+  // The headers getter may allocate a new object, so only read it when needed.
+  if (validatorFunction == null) return false
+  const value = request[paramName]
   let ret
 
   try {
-    const data = isUndefined ? null : request[paramName]
+    const data = value === undefined ? null : value
     // Ajv can only mutate a root value when its parent is provided.
-    if (validatorFunction?.schemaEnv) {
+    if (validatorFunction.schemaEnv) {
       ret = validatorFunction(data, {
         parentData: request,
         parentDataProperty: paramName
       })
     } else {
-      ret = validatorFunction?.(data)
+      ret = validatorFunction(data)
     }
   } catch (err) {
     // If validator throws synchronously, ensure it propagates as an internal error

package/lib/warnings.js

@@ -7,6 +7,7 @@ const { createWarning } = require('process-warning')
  *   - FSTWRN001
  *   - FSTSEC001
  *   - FSTSEC002
+ *   - FSTSEC003
  *   - FSTDEP022
  *   - FSTDEP023
  *   - FSTDEP024
@@ -52,6 +53,13 @@ const FSTSEC002 = createWarning({
   unlimited: true
 })
 
+const FSTSEC003 = createWarning({
+  name: 'FastifySecurity',
+  code: 'FSTSEC003',
+  message: 'The headers schema for %s: %s uses a $ref (%s) inside propertyNames that is not case-normalized. Header names held in the referenced schema keep their original case and will not match the lowercased request headers, so a case-insensitive deny-list or allow-list on header names may not apply. Inline the propertyNames constraint instead of referencing it with a $ref.',
+  unlimited: true
+})
+
 const FSTDEP022 = createWarning({
   name: 'FastifyWarning',
   code: 'FSTDEP022',
@@ -86,6 +94,7 @@ module.exports = {
   FSTWRN004,
   FSTSEC001,
   FSTSEC002,
+  FSTSEC003,
   FSTDEP022,
   FSTDEP023,
   FSTDEP024,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastify",
-  "version": "5.12.4",
+  "version": "5.12.6",
   "description": "Fast and low overhead web framework, for Node.js",
   "main": "fastify.js",
   "type": "commonjs",

package/test/child-logger-factory.test.js

@@ -126,3 +126,28 @@ test('should throw error if invalid logger is returned', (t, done) => {
     }, { code: 'FST_ERR_LOG_INVALID_LOGGER' })
   })
 })
+
+test('request child loggers only receive a level when the route sets one', async t => {
+  t.plan(3)
+
+  const fastify = Fastify({ logger: { level: 'info', stream: { write () {} } } })
+  const levels = []
+  fastify.setChildLoggerFactory(function (logger, bindings, opts) {
+    // an empty level would make pino reset the level of every request child
+    levels.push(Object.hasOwn(opts, 'level') ? opts.level : 'inherited')
+    return logger.child(bindings, opts)
+  })
+
+  fastify.get('/', (req, reply) => {
+    reply.send(req.log.level)
+  })
+  fastify.get('/warn', { logLevel: 'warn' }, (req, reply) => {
+    reply.send(req.log.level)
+  })
+
+  t.after(() => fastify.close())
+
+  t.assert.strictEqual((await fastify.inject('/')).body, 'info')
+  t.assert.strictEqual((await fastify.inject('/warn')).body, 'warn')
+  t.assert.deepStrictEqual(levels, ['inherited', 'warn'])
+})

package/test/content-parser.test.js

@@ -2,6 +2,7 @@
 
 const { test } = require('node:test')
 const { spyWarning } = require('process-warning')
+const { Readable } = require('node:stream')
 const Fastify = require('..')
 const keys = require('../lib/symbols')
 const { FST_ERR_CTP_ALREADY_PRESENT, FST_ERR_CTP_INVALID_TYPE, FST_ERR_CTP_INVALID_MEDIA_TYPE } = require('../lib/errors')
@@ -767,3 +768,62 @@ test('content-type fail when not a valid type', async t => {
     t.assert.equal(error.message, 'The content type should be a string or a RegExp')
   }
 })
+
+test('string body keeps multi-byte characters split across chunks', async t => {
+  t.plan(2)
+
+  const fastify = Fastify()
+  const encoded = Buffer.from(JSON.stringify({ hello: 'wörld ✓ 😀' }))
+
+  fastify.addHook('preParsing', async () => {
+    // Emit one byte per chunk so every multi-byte character is split
+    return Readable.from(Array.from(encoded, byte => Buffer.from([byte])), { objectMode: false })
+  })
+  fastify.post('/', async (request) => request.body)
+
+  const res = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    headers: { 'content-type': 'application/json' },
+    payload: encoded
+  })
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.deepStrictEqual(res.json(), { hello: 'wörld ✓ 😀' })
+})
+
+test('string body accepts string chunks from a preParsing stream', async t => {
+  t.plan(2)
+
+  const fastify = Fastify()
+
+  fastify.addHook('preParsing', async (request, reply, payload) => {
+    payload.setEncoding('utf8')
+    return payload
+  })
+  fastify.post('/', async (request) => request.body)
+
+  const res = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    headers: { 'content-type': 'text/plain' },
+    payload: 'hellö'
+  })
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.body, 'hellö')
+})
+
+test('string body with invalid UTF-8 is not treated as a content-length mismatch', async t => {
+  t.plan(2)
+
+  const fastify = Fastify()
+  fastify.post('/', async (request) => request.body)
+
+  const res = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    headers: { 'content-type': 'text/plain' },
+    payload: Buffer.from([0x61, 0xff, 0x62])
+  })
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.body, 'a�b')
+})