fastify 5.6.2 → 5.7.1

package/lib/error-handler.js

@@ -2,11 +2,11 @@
 
 const statusCodes = require('node:http').STATUS_CODES
 const wrapThenable = require('./wrap-thenable.js')
+const { setErrorStatusCode } = require('./error-status.js')
 const {
   kReplyHeaders,
   kReplyNextErrorHandler,
   kReplyIsRunningOnErrorHook,
-  kReplyHasStatusCode,
   kRouteContext,
   kDisableRequestLogging
 } = require('./symbols.js')
@@ -81,10 +81,7 @@ function handleError (reply, error, cb) {
 
 function defaultErrorHandler (error, request, reply) {
   setErrorHeaders(error, reply)
-  if (!reply[kReplyHasStatusCode] || reply.statusCode === 200) {
-    const statusCode = error && (error.statusCode || error.status)
-    reply.code(statusCode >= 400 ? statusCode : 500)
-  }
+  setErrorStatusCode(reply, error)
   if (reply.statusCode < 500) {
     if (!reply.log[kDisableRequestLogging]) {
       reply.log.info(

package/lib/error-status.js

@@ -0,0 +1,14 @@
+'use strict'
+
+const {
+  kReplyHasStatusCode
+} = require('./symbols')
+
+function setErrorStatusCode (reply, err) {
+  if (!reply[kReplyHasStatusCode] || reply.statusCode === 200) {
+    const statusCode = err && (err.statusCode || err.status)
+    reply.code(statusCode >= 400 ? statusCode : 500)
+  }
+}
+
+module.exports = { setErrorStatusCode }

package/lib/four-oh-four.js

@@ -49,7 +49,8 @@ function fourOhFour (options) {
   function basic404 (request, reply) {
     const { url, method } = request.raw
     const message = `Route ${method}:${url} not found`
-    if (!disableRequestLogging) {
+    const resolvedDisableRequestLogging = typeof disableRequestLogging === 'function' ? disableRequestLogging(request.raw) : disableRequestLogging
+    if (!resolvedDisableRequestLogging) {
       request.log.info(message)
     }
     reply.code(404).send({

package/lib/handle-request.js

@@ -4,6 +4,7 @@ const diagnostics = require('node:diagnostics_channel')
 const { validate: validateSchema } = require('./validation')
 const { preValidationHookRunner, preHandlerHookRunner } = require('./hooks')
 const wrapThenable = require('./wrap-thenable')
+const { setErrorStatusCode } = require('./error-status')
 const {
   kReplyIsError,
   kRouteContext,
@@ -143,11 +144,13 @@ function preHandlerCallbackInner (err, request, reply, store) {
   try {
     if (err != null) {
       reply[kReplyIsError] = true
-      reply.send(err)
       if (store) {
         store.error = err
+        // Set status code before publishing so subscribers see the correct value
+        setErrorStatusCode(reply, err)
         channels.error.publish(store)
       }
+      reply.send(err)
       return
     }
 
@@ -158,6 +161,8 @@ function preHandlerCallbackInner (err, request, reply, store) {
     } catch (err) {
       if (store) {
         store.error = err
+        // Set status code before publishing so subscribers see the correct value
+        setErrorStatusCode(reply, err)
         channels.error.publish(store)
       }
 

package/lib/reply.js

@@ -1,7 +1,6 @@
 'use strict'
 
 const eos = require('node:stream').finished
-const Readable = require('node:stream').Readable
 
 const {
   kFourOhFourContext,
@@ -685,8 +684,59 @@ function sendWebStream (payload, res, reply) {
   if (payload.locked) {
     throw new FST_ERR_REP_READABLE_STREAM_LOCKED()
   }
-  const nodeStream = Readable.fromWeb(payload)
-  sendStream(nodeStream, res, reply)
+
+  let sourceOpen = true
+  let errorLogged = false
+  const reader = payload.getReader()
+
+  eos(res, function (err) {
+    if (sourceOpen) {
+      if (err != null && res.headersSent && !errorLogged) {
+        errorLogged = true
+        logStreamError(reply.log, err, res)
+      }
+      reader.cancel().catch(noop)
+    }
+  })
+
+  if (!res.headersSent) {
+    for (const key in reply[kReplyHeaders]) {
+      res.setHeader(key, reply[kReplyHeaders][key])
+    }
+  } else {
+    reply.log.warn('response will send, but you shouldn\'t use res.writeHead in stream mode')
+  }
+
+  function onRead (result) {
+    if (result.done) {
+      sourceOpen = false
+      sendTrailer(null, res, reply)
+      return
+    }
+    /* c8 ignore next 5 - race condition: eos handler typically fires first */
+    if (res.destroyed) {
+      sourceOpen = false
+      reader.cancel().catch(noop)
+      return
+    }
+    res.write(result.value)
+    reader.read().then(onRead, onReadError)
+  }
+
+  function onReadError (err) {
+    sourceOpen = false
+    if (res.headersSent || reply.request.raw.aborted === true) {
+      if (!errorLogged) {
+        errorLogged = true
+        logStreamError(reply.log, err, reply)
+      }
+      res.destroy()
+    } else {
+      onErrorHook(reply, err)
+    }
+  }
+
+  reader.read().then(onRead, onReadError)
 }
 
 function sendStream (payload, res, reply) {

package/lib/route.js

@@ -29,8 +29,6 @@ const {
   FST_ERR_HOOK_INVALID_ASYNC_HANDLER
 } = require('./errors')
 
-const { FSTDEP022 } = require('./warnings')
-
 const {
   kRoutePrefix,
   kSupportedHTTPMethods,
@@ -53,6 +51,7 @@ const {
 const { buildErrorHandler } = require('./error-handler')
 const { createChildLogger } = require('./logger-factory.js')
 const { getGenReqId } = require('./req-id-gen-factory.js')
+const { FSTDEP022 } = require('./warnings')
 
 const routerKeys = [
   'allowUnsafeRegex',
@@ -69,7 +68,7 @@ const routerKeys = [
 ]
 
 function buildRouting (options) {
-  const router = FindMyWay(options.config)
+  const router = FindMyWay(options)
 
   let avvio
   let fourOhFour
@@ -78,6 +77,7 @@ function buildRouting (options) {
   let setupResponseListeners
   let throwIfAlreadyStarted
   let disableRequestLogging
+  let disableRequestLoggingFn
   let ignoreTrailingSlash
   let ignoreDuplicateSlashes
   let return503OnClosing
@@ -94,13 +94,17 @@ function buildRouting (options) {
     setup (options, fastifyArgs) {
       avvio = fastifyArgs.avvio
       fourOhFour = fastifyArgs.fourOhFour
+      logger = options.logger
       hasLogger = fastifyArgs.hasLogger
       setupResponseListeners = fastifyArgs.setupResponseListeners
       throwIfAlreadyStarted = fastifyArgs.throwIfAlreadyStarted
 
-      logger = options.logger
       globalExposeHeadRoutes = options.exposeHeadRoutes
       disableRequestLogging = options.disableRequestLogging
+      if (typeof disableRequestLogging === 'function') {
+        disableRequestLoggingFn = options.disableRequestLogging
+      }
+
       ignoreTrailingSlash = options.routerOptions.ignoreTrailingSlash
       ignoreDuplicateSlashes = options.routerOptions.ignoreDuplicateSlashes
       return503OnClosing = Object.hasOwn(options, 'return503OnClosing') ? options.return503OnClosing : true
@@ -373,9 +377,8 @@ function buildRouting (options) {
         context.logSerializers = opts.logSerializers
         context.attachValidation = opts.attachValidation
         context[kReplySerializerDefault] = this[kReplySerializerDefault]
-        context.schemaErrorFormatter = opts.schemaErrorFormatter ||
-          this[kSchemaErrorFormatter] ||
-          context.schemaErrorFormatter
+        context.schemaErrorFormatter =
+          opts.schemaErrorFormatter || this[kSchemaErrorFormatter] || context.schemaErrorFormatter
 
         // Run hooks and more
         avvio.once('preReady', () => {
@@ -402,9 +405,11 @@ function buildRouting (options) {
             context.schema = normalizeSchema(context.schema, this.initialConfig)
 
             const schemaController = this[kSchemaController]
-            if (!opts.validatorCompiler && (
-              opts.schema.body || opts.schema.headers || opts.schema.querystring || opts.schema.params
-            )) {
+            const hasValidationSchema = opts.schema.body ||
+              opts.schema.headers ||
+              opts.schema.querystring ||
+              opts.schema.params
+            if (!opts.validatorCompiler && hasValidationSchema) {
               schemaController.setupValidator(this[kOptions])
             }
             try {
@@ -455,7 +460,8 @@ function buildRouting (options) {
       loggerOpts.serializers = context.logSerializers
     }
     const childLogger = createChildLogger(context, logger, req, id, loggerOpts)
-    childLogger[kDisableRequestLogging] = disableRequestLogging
+    // Set initial value; will be re-evaluated after FastifyRequest is constructed if it's a function
+    childLogger[kDisableRequestLogging] = disableRequestLoggingFn ? false : disableRequestLogging
 
     if (closing === true) {
       /* istanbul ignore next mac, windows */
@@ -499,7 +505,15 @@ function buildRouting (options) {
 
     const request = new context.Request(id, params, req, query, childLogger, context)
     const reply = new context.Reply(res, request, childLogger)
-    if (disableRequestLogging === false) {
+
+    // Evaluate disableRequestLogging after FastifyRequest is constructed
+    // so the caller has access to decorations and customizations
+    const resolvedDisableRequestLogging = disableRequestLoggingFn
+      ? disableRequestLoggingFn(request)
+      : disableRequestLogging
+    childLogger[kDisableRequestLogging] = resolvedDisableRequestLogging
+
+    if (resolvedDisableRequestLogging === false) {
       childLogger.info({ req: request }, 'incoming request')
     }
 

package/lib/schema-controller.js

@@ -1,8 +1,6 @@
 'use strict'
 
 const { buildSchemas } = require('./schemas')
-const SerializerSelector = require('@fastify/fast-json-stringify-compiler')
-const ValidatorSelector = require('@fastify/ajv-compiler')
 
 /**
  * Called at every fastify context that is being created.
@@ -21,9 +19,11 @@ function buildSchemaController (parentSchemaCtrl, opts) {
   }, opts?.compilersFactory)
 
   if (!compilersFactory.buildValidator) {
+    const ValidatorSelector = require('@fastify/ajv-compiler')
     compilersFactory.buildValidator = ValidatorSelector()
   }
   if (!compilersFactory.buildSerializer) {
+    const SerializerSelector = require('@fastify/fast-json-stringify-compiler')
     compilersFactory.buildSerializer = SerializerSelector()
   }
 

package/lib/wrap-thenable.js

@@ -4,6 +4,7 @@ const {
   kReplyIsError,
   kReplyHijacked
 } = require('./symbols')
+const { setErrorStatusCode } = require('./error-status')
 
 const diagnostics = require('node:diagnostics_channel')
 const channels = diagnostics.tracingChannel('fastify.request.handler')
@@ -52,6 +53,8 @@ function wrapThenable (thenable, reply, store) {
   }, function (err) {
     if (store) {
       store.error = err
+      // Set status code before publishing so subscribers see the correct value
+      setErrorStatusCode(reply, err)
       channels.error.publish(store) // note that error happens before asyncStart
       channels.asyncStart.publish(store)
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastify",
-  "version": "5.6.2",
+  "version": "5.7.1",
   "description": "Fast and low overhead web framework, for Node.js",
   "main": "fastify.js",
   "type": "commonjs",
@@ -171,7 +171,7 @@
     "@sinonjs/fake-timers": "^11.2.2",
     "@stylistic/eslint-plugin": "^5.1.0",
     "@stylistic/eslint-plugin-js": "^4.1.0",
-    "@types/node": "^24.0.12",
+    "@types/node": "^25.0.3",
     "ajv": "^8.12.0",
     "ajv-errors": "^3.0.0",
     "ajv-formats": "^3.0.1",
@@ -191,7 +191,7 @@
     "joi": "^18.0.1",
     "json-schema-to-ts": "^3.0.1",
     "JSONStream": "^1.3.5",
-    "markdownlint-cli2": "^0.18.1",
+    "markdownlint-cli2": "^0.20.0",
     "neostandard": "^0.12.0",
     "node-forge": "^1.3.1",
     "proxyquire": "^2.1.3",
@@ -203,7 +203,7 @@
     "yup": "^1.4.0"
   },
   "dependencies": {
-    "@fastify/ajv-compiler": "^4.0.0",
+    "@fastify/ajv-compiler": "^4.0.5",
     "@fastify/error": "^4.0.0",
     "@fastify/fast-json-stringify-compiler": "^5.0.0",
     "@fastify/proxy-addr": "^5.0.0",

package/test/404s.test.js

@@ -1845,6 +1845,26 @@ test('400 in case of bad url (pre find-my-way v2.2.0 was a 404)', async t => {
       done()
     })
   })
+
+  await t.test('Bad URL with special characters should be properly JSON escaped', (t, done) => {
+    t.plan(3)
+    const fastify = Fastify()
+    fastify.get('/hello/:id', () => t.assert.fail('we should not be here'))
+    fastify.inject({
+      url: '/hello/%world%22test',
+      method: 'GET'
+    }, (err, response) => {
+      t.assert.ifError(err)
+      t.assert.strictEqual(response.statusCode, 400)
+      t.assert.deepStrictEqual(JSON.parse(response.payload), {
+        error: 'Bad Request',
+        message: '\'/hello/%world%22test\' is not a valid url component',
+        statusCode: 400,
+        code: 'FST_ERR_BAD_URL'
+      })
+      done()
+    })
+  })
 })
 
 test('setNotFoundHandler should be chaining fastify instance', async t => {
@@ -1964,3 +1984,52 @@ test('hooks are applied to not found handlers /3', async t => {
   const { statusCode } = await fastify.inject('/')
   t.assert.strictEqual(statusCode, 401)
 })
+
+test('should honor disableRequestLogging function for 404', async t => {
+  t.plan(3)
+
+  const Writable = require('node:stream').Writable
+
+  const logStream = new Writable()
+  logStream.logs = []
+  logStream._write = function (chunk, encoding, callback) {
+    this.logs.push(JSON.parse(chunk.toString()))
+    callback()
+  }
+
+  const fastify = Fastify({
+    logger: {
+      level: 'info',
+      stream: logStream
+    },
+    disableRequestLogging: (req) => {
+      // Disable logging for URLs containing 'silent'
+      return req.url.includes('silent')
+    }
+  })
+
+  fastify.get('/', function (req, reply) {
+    reply.send({ hello: 'world' })
+  })
+
+  t.after(() => { fastify.close() })
+
+  // First request to a non-existent route (no 'silent' in URL) - should log
+  const response1 = await fastify.inject({
+    method: 'GET',
+    url: '/not-found'
+  })
+  t.assert.strictEqual(response1.statusCode, 404)
+
+  // Second request to a non-existent route with 'silent' in URL - should not log
+  const response2 = await fastify.inject({
+    method: 'GET',
+    url: '/silent-route'
+  })
+  t.assert.strictEqual(response2.statusCode, 404)
+
+  // Check logs: first request should have logged, second should not
+  // We expect: incoming request, Route not found info, request completed (for first request only)
+  const infoLogs = logStream.logs.filter(log => log.msg && log.msg.includes('Route GET:/not-found not found'))
+  t.assert.strictEqual(infoLogs.length, 1, 'Should log 404 info only for non-silent route')
+})

package/test/diagnostics-channel/error-status.test.js

@@ -5,6 +5,90 @@ const Fastify = require('../..')
 const statusCodes = require('node:http').STATUS_CODES
 const diagnostics = require('node:diagnostics_channel')
 
+test('diagnostics channel error event should report correct status code', async (t) => {
+  t.plan(3)
+  const fastify = Fastify()
+  t.after(() => fastify.close())
+
+  let diagnosticsStatusCode
+
+  const channel = diagnostics.channel('tracing:fastify.request.handler:error')
+  const handler = (msg) => {
+    diagnosticsStatusCode = msg.reply.statusCode
+  }
+  channel.subscribe(handler)
+  t.after(() => channel.unsubscribe(handler))
+
+  fastify.get('/', async () => {
+    const err = new Error('test error')
+    err.statusCode = 503
+    throw err
+  })
+
+  const res = await fastify.inject('/')
+
+  t.assert.strictEqual(res.statusCode, 503)
+  t.assert.strictEqual(diagnosticsStatusCode, 503, 'diagnostics channel should report correct status code')
+  t.assert.strictEqual(diagnosticsStatusCode, res.statusCode, 'diagnostics status should match response status')
+})
+
+test('diagnostics channel error event should report 500 for errors without status', async (t) => {
+  t.plan(3)
+  const fastify = Fastify()
+  t.after(() => fastify.close())
+
+  let diagnosticsStatusCode
+
+  const channel = diagnostics.channel('tracing:fastify.request.handler:error')
+  const handler = (msg) => {
+    diagnosticsStatusCode = msg.reply.statusCode
+  }
+  channel.subscribe(handler)
+  t.after(() => channel.unsubscribe(handler))
+
+  fastify.get('/', async () => {
+    throw new Error('plain error without status')
+  })
+
+  const res = await fastify.inject('/')
+
+  t.assert.strictEqual(res.statusCode, 500)
+  t.assert.strictEqual(diagnosticsStatusCode, 500, 'diagnostics channel should report 500 for plain errors')
+  t.assert.strictEqual(diagnosticsStatusCode, res.statusCode, 'diagnostics status should match response status')
+})
+
+test('diagnostics channel error event should report correct status with custom error handler', async (t) => {
+  t.plan(3)
+  const fastify = Fastify()
+  t.after(() => fastify.close())
+
+  let diagnosticsStatusCode
+
+  const channel = diagnostics.channel('tracing:fastify.request.handler:error')
+  const handler = (msg) => {
+    diagnosticsStatusCode = msg.reply.statusCode
+  }
+  channel.subscribe(handler)
+  t.after(() => channel.unsubscribe(handler))
+
+  fastify.setErrorHandler((error, request, reply) => {
+    reply.status(503).send({ error: error.message })
+  })
+
+  fastify.get('/', async () => {
+    throw new Error('handler error')
+  })
+
+  const res = await fastify.inject('/')
+
+  // Note: The diagnostics channel fires before the custom error handler runs,
+  // so it reports 500 (default) rather than 503 (set by custom handler).
+  // This is expected behavior - the error channel reports the initial error state.
+  t.assert.strictEqual(res.statusCode, 503)
+  t.assert.strictEqual(diagnosticsStatusCode, 500, 'diagnostics channel reports status before custom handler')
+  t.assert.notStrictEqual(diagnosticsStatusCode, res.statusCode, 'custom handler can change status after diagnostics')
+})
+
 test('Error.status property support', (t, done) => {
   t.plan(4)
   const fastify = Fastify()

package/test/internals/schema-controller-perf.test.js

@@ -0,0 +1,40 @@
+const { sep } = require('node:path')
+const { test } = require('node:test')
+const Fastify = require('../../fastify')
+
+test('SchemaController are NOT loaded when the controllers are custom', async t => {
+  const app = Fastify({
+    schemaController: {
+      compilersFactory: {
+        buildValidator: () => () => { },
+        buildSerializer: () => () => { }
+      }
+    }
+  })
+
+  await app.ready()
+
+  const loaded = Object.keys(require.cache)
+  const ajvModule = loaded.find((path) => path.includes(`@fastify${sep}ajv-compiler`))
+  const stringifyModule = loaded.find((path) => path.includes(`@fastify${sep}fast-json-stringify-compiler`))
+
+  t.assert.equal(ajvModule, undefined, 'Ajv compiler is loaded')
+  t.assert.equal(stringifyModule, undefined, 'Stringify compiler is loaded')
+})
+
+test('SchemaController are loaded when the controllers are not custom', async t => {
+  const app = Fastify()
+  await app.ready()
+
+  const loaded = Object.keys(require.cache)
+  const ajvModule = loaded.find((path) => path.includes(`@fastify${sep}ajv-compiler`))
+  const stringifyModule = loaded.find((path) => path.includes(`@fastify${sep}fast-json-stringify-compiler`))
+
+  t.after(() => {
+    delete require.cache[ajvModule]
+    delete require.cache[stringifyModule]
+  })
+
+  t.assert.ok(ajvModule, 'Ajv compiler is loaded')
+  t.assert.ok(stringifyModule, 'Stringify compiler is loaded')
+})

package/test/issue-4959.test.js

@@ -11,7 +11,7 @@ const { setTimeout } = require('node:timers')
 *
 * @see https://github.com/fastify/fastify/issues/4959
 */
-function runBadClientCall (reqOptions, payload) {
+function runBadClientCall (reqOptions, payload, waitBeforeDestroy) {
   let innerResolve, innerReject
   const promise = new Promise((resolve, reject) => {
     innerResolve = resolve
@@ -30,11 +30,25 @@ function runBadClientCall (reqOptions, payload) {
     innerReject(new Error('Request should have failed'))
   })
 
-  // Kill the socket immediately (before sending data)
-  req.on('socket', (socket) => {
-    socket.on('connect', () => {
-      setTimeout(() => { socket.destroy() }, 0)
-    })
+  // Kill the socket after the request has been fully written.
+  // Destroying it on `connect` can race before any bytes are sent, making the
+  // server-side assertions (hooks/handler) non-deterministic.
+  //
+  // To keep the test deterministic, we optionally wait for a server-side signal
+  // (e.g. onSend entered) before aborting the client.
+  let socket
+  req.on('socket', (s) => { socket = s })
+  req.on('finish', () => {
+    if (waitBeforeDestroy && typeof waitBeforeDestroy.then === 'function') {
+      Promise.race([
+        waitBeforeDestroy,
+        new Promise(resolve => setTimeout(resolve, 200))
+      ]).then(() => {
+        if (socket) socket.destroy()
+      }, innerResolve)
+      return
+    }
+    setTimeout(() => { socket.destroy() }, 0)
   })
   req.on('error', innerResolve)
   req.write(postData)
@@ -47,6 +61,11 @@ test('should handle a socket error', async (t) => {
   t.plan(4)
   const fastify = Fastify()
 
+  let resolveOnSendEntered
+  const onSendEntered = new Promise((resolve) => {
+    resolveOnSendEntered = resolve
+  })
+
   function shouldNotHappen () {
     t.assert.fail('This should not happen')
   }
@@ -70,8 +89,14 @@ test('should handle a socket error', async (t) => {
     t.assert.ok('onSend hook called')
     request.onSendCalled = true
 
-    // Introduce a delay
-    await new Promise(resolve => setTimeout(resolve, 5))
+    if (resolveOnSendEntered) {
+      resolveOnSendEntered()
+      resolveOnSendEntered = null
+    }
+
+    // Introduce a delay (gives time for client-side abort to happen while the
+    // request has already been processed, exercising the original issue).
+    await new Promise(resolve => setTimeout(resolve, 50))
     return payload
   })
 
@@ -88,6 +113,6 @@ test('should handle a socket error', async (t) => {
     port: fastify.server.address().port,
     path: '/',
     method: 'PUT'
-  }, { test: 'me' })
+  }, { test: 'me' }, onSendEntered)
   t.assert.equal(err.code, 'ECONNRESET')
 })

package/test/listen.1.test.js

@@ -1,5 +1,6 @@
 'use strict'
 
+const { networkInterfaces } = require('node:os')
 const { test, before } = require('node:test')
 const Fastify = require('..')
 const helper = require('./helper')
@@ -41,7 +42,14 @@ test('Async/await listen with arguments', async t => {
   })
   const addr = await fastify.listen({ port: 0, host: '0.0.0.0' })
   const address = fastify.server.address()
-  t.assert.strictEqual(addr, `http://127.0.0.1:${address.port}`)
+  const { protocol, hostname, port, pathname } = new URL(addr)
+  t.assert.strictEqual(protocol, 'http:')
+  t.assert.ok(Object.values(networkInterfaces())
+    .flat()
+    .filter(({ internal }) => internal)
+    .some(({ address }) => address === hostname))
+  t.assert.strictEqual(pathname, '/')
+  t.assert.strictEqual(Number(port), address.port)
   t.assert.deepEqual(address, {
     address: '0.0.0.0',
     family: 'IPv4',