fastify 6.0.0-alpha.4 → 6.0.0-alpha.5

package/SECURITY.md

@@ -30,6 +30,12 @@ The following are **not** considered vulnerabilities in Fastify:
 
 - **Application code vulnerabilities**: XSS, SQL injection, or other flaws in
 user-written route handlers, hooks, or plugins
+- **Unvalidated template selection**: Passing untrusted input directly as a
+template name or path (for example, `reply.view(request.query.page)`) without
+validating or allowlisting it is an application-level vulnerability. A template
+root used to resolve filenames is not a security sandbox unless the API
+explicitly guarantees path containment. Bypasses of documented containment
+or built-in path validation remain in scope.
 - **Malicious application code**: Issues caused by intentionally malicious
 plugins or handlers (application code is trusted)
 - **Validation schema issues**: Weak or incorrect schemas provided by developers

package/docs/Guides/Ecosystem.md

@@ -172,8 +172,6 @@ section.
   A plugin to help with caching API responses using AWS DynamoDB.
 - [`@clerk/fastify`](https://github.com/clerk/javascript/tree/main/packages/fastify)
   Add authentication and user management to your Fastify application with Clerk.
-- [`@coobaha/typed-fastify`](https://github.com/Coobaha/typed-fastify) Strongly
-  typed routes with a runtime validation using JSON schema generated from types.
 - [`@dnlup/fastify-doc`](https://github.com/dnlup/fastify-doc) A plugin for
   sampling process metrics.
 - [`@dnlup/fastify-traps`](https://github.com/dnlup/fastify-traps) A plugin to
@@ -211,6 +209,9 @@ section.
 - [`@matths/fastify-svelte-view`](https://github.com/matths/fastify-svelte-view)
   A Fastify plugin for rendering Svelte components with support for SSR
   (Server-Side Rendering), CSR (Client-Side Rendering), and SSR with hydration.
+- [`@melroy89/fastify-mariadb`](https://github.com/melroy89/fastify-mariadb)
+  Fastify MariaDB connection plugin that shares a connection pool across the
+  server.
 - [`@mgcrea/fastify-graceful-exit`](https://github.com/mgcrea/fastify-graceful-exit)
   A plugin to close the server gracefully
 - [`@mgcrea/fastify-request-logger`](https://github.com/mgcrea/fastify-request-logger)
@@ -240,6 +241,9 @@ section.
   method with a body).
 - [`@trubavuong/fastify-seaweedfs`](https://github.com/trubavuong/fastify-seaweedfs)
   SeaweedFS for Fastify
+- [`@validex/fastify`](https://github.com/chiptoma/validex/tree/main/packages/fastify)
+  Zod 4 validation plugin with 25 typed rules, structured error codes, and
+  `request.validate()` decorator.
 - [`@yeliex/fastify-problem-details`](https://github.com/yeliex/fastify-problem-details)
   RFC 9457 Problem Details implementation for Fastify, with typed HTTP errors.
 - [`@zrosenbauer/fastify-prisma`](https://github.com/zrosenbauer/fastify-prisma)
@@ -249,8 +253,6 @@ section.
   logging and monitoring tool.
 - [`arecibo`](https://github.com/ducktors/arecibo) Fastify ping responder for
   Kubernetes Liveness and Readiness Probes.
-- [`aws-xray-sdk-fastify`](https://github.com/aws/aws-xray-sdk-node/tree/master/sdk_contrib/fastify)
-  A Fastify plugin to log requests and subsegments through AWSXray.
 - [`cls-rtracer`](https://github.com/puzpuzpuz/cls-rtracer) Fastify middleware
   for CLS-based request ID generation. An out-of-the-box solution for adding
   request IDs into your logs.
@@ -274,14 +276,8 @@ section.
 - [`fastify-amqp-async`](https://github.com/kffl/fastify-amqp-async) Fastify
   AMQP plugin with a Promise-based API provided by
   [`amqplib-as-promised`](https://github.com/twawszczak/amqplib-as-promised).
-- [`fastify-angular-universal`](https://github.com/exequiel09/fastify-angular-universal)
-  Angular server-side rendering support using
-  [`@angular/platform-server`](https://github.com/angular/angular/tree/master/packages/platform-server)
-  for Fastify
 - [`fastify-api-key`](https://github.com/arkerone/fastify-api-key) Fastify
   plugin to authenticate HTTP requests based on API key and signature
-- [`fastify-appwrite`](https://github.com/maniecodes/fastify-appwrite) Fastify
-  Plugin for interacting with Appwrite server.
 - [`fastify-arktype`](https://github.com/BlairCurrey/fastify-arktype) ArkType
   type provider with validation and @fastify/swagger OpenAPI generation.
 - [`fastify-asyncforge`](https://github.com/mcollina/fastify-asyncforge) Plugin
@@ -298,15 +294,9 @@ section.
   Auth0 verification plugin for Fastify, internally uses
   [fastify-jwt](https://www.npmjs.com/package/fastify-jwt) and
   [jsonwebtoken](https://www.npmjs.com/package/jsonwebtoken).
-- [`fastify-autoroutes`](https://github.com/GiovanniCardamone/fastify-autoroutes)
-  Plugin to scan and load routes based on filesystem path from a custom
-  directory.
 - [`fastify-aws-sns`](https://github.com/gzileni/fastify-aws-sns) Fastify plugin
   for AWS Simple Notification Service (AWS SNS) that coordinates and manages
   the delivery or sending of messages to subscribing endpoints or clients.
-- [`fastify-aws-timestream`](https://github.com/gzileni/fastify-aws-timestream)
-  Fastify plugin for managing databases, tables, and querying and creating
-  scheduled queries with AWS Timestream.
 - [`fastify-axios`](https://github.com/davidedantonio/fastify-axios) Plugin to
   send HTTP requests via [axios](https://github.com/axios/axios).
 - [`fastify-babel`](https://github.com/cfware/fastify-babel) Fastify plugin for
@@ -341,9 +331,6 @@ section.
   Fastify plugin for CloudFlare Turnstile.
 - [`fastify-cloudinary`](https://github.com/Vanilla-IceCream/fastify-cloudinary)
   Plugin to share a common Cloudinary connection across Fastify.
-- [`fastify-cockroachdb`](https://github.com/alex-ppg/fastify-cockroachdb)
-  Fastify plugin to connect to a CockroachDB PostgreSQL instance via the
-  Sequelize ORM.
 - [`fastify-constraints`](https://github.com/nearform/fastify-constraints)
   Fastify plugin to add constraints to multiple routes
 - [`fastify-couchdb`](https://github.com/nigelhanlon/fastify-couchdb) Fastify
@@ -361,10 +348,6 @@ section.
 - [`fastify-disablecache`](https://github.com/Fdawgs/fastify-disablecache)
   Fastify plugin to disable client-side caching, inspired by
   [nocache](https://github.com/helmetjs/nocache).
-- [`fastify-dynamodb`](https://github.com/matrus2/fastify-dynamodb) AWS DynamoDB
-  plugin for Fastify. It exposes
-  [AWS.DynamoDB.DocumentClient()](https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/DynamoDB/DocumentClient.html)
-  object.
 - [`fastify-dynareg`](https://github.com/greguz/fastify-dynareg) Dynamic plugin
   register for Fastify.
 - [`fastify-envalid`](https://github.com/alemagio/fastify-envalid) Fastify
@@ -372,9 +355,6 @@ section.
   project.
 - [`fastify-error-page`](https://github.com/hemerajs/fastify-error-page) Fastify
   plugin to print errors in structured HTML to the browser.
-- [`fastify-esso`](https://github.com/patrickpissurno/fastify-esso) The easiest
-  authentication plugin for Fastify, with built-in support for Single sign-on
-  (and great documentation).
 - [`fastify-event-bus`](https://github.com/Shiva127/fastify-event-bus) Event bus
   support for Fastify. Built upon [js-event-bus](https://github.com/bcerati/js-event-bus).
 - [`fastify-evervault`](https://github.com/Briscoooe/fastify-evervault/) Fastify
@@ -457,14 +437,10 @@ section.
   plugin to serialize JSON responses into XML.
 - [`fastify-jwt-authz`](https://github.com/Ethan-Arrowood/fastify-jwt-authz) JWT
   user scope verifier.
-- [`fastify-jwt-webapp`](https://github.com/charlesread/fastify-jwt-webapp) JWT
-  authentication for Fastify-based web apps.
 - [`fastify-kafkajs`](https://github.com/kffl/fastify-kafkajs) Fastify plugin
   that adds support for KafkaJS - a modern Apache Kafka client library.
 - [`fastify-keycloak-adapter`](https://github.com/yubinTW/fastify-keycloak-adapter)
   A keycloak adapter for a Fastify app.
-- [`fastify-koa`](https://github.com/rozzilla/fastify-koa) Convert Koa
-middlewares into Fastify plugins
 - [`fastify-kubernetes`](https://github.com/greguz/fastify-kubernetes) Fastify
   Kubernetes client plugin.
 - [`fastify-kysely`](https://github.com/alenap93/fastify-kysely) Fastify
@@ -504,6 +480,8 @@ middlewares into Fastify plugins
 - [`fastify-mongoose-driver`](https://github.com/alex-ppg/fastify-mongoose)
   Fastify Mongoose plugin that connects to a MongoDB via the Mongoose plugin
   with support for Models.
+- [`fastify-mosquitto-dynsec`](https://github.com/LuizTakeda/fastify-mosquitto-dynsec)
+  Fastify plugin to manage Mosquitto Dynamic Security over MQTT.
 - [`fastify-mqtt`](https://github.com/love-lena/fastify-mqtt) Plugin to share
   [mqtt](https://www.npmjs.com/package/mqtt) client across Fastify.
 - [`fastify-msgpack`](https://github.com/kenriortega/fastify-msgpack) Fastify
@@ -546,8 +524,6 @@ middlewares into Fastify plugins
   [`oracledb`](https://github.com/oracle/node-oracledb) connection pool to a
   Fastify server instance.
 - [`fastify-orama`](https://github.com/mateonunez/fastify-orama)
-- [`fastify-osm`](https://github.com/gzileni/fastify-osm) Fastify
-  OSM plugin to run overpass queries by OpenStreetMap.
 - [`fastify-override`](https://github.com/matthyk/fastify-override)
   Fastify plugin to override decorators, plugins and hooks for testing purposes
 - [`fastify-param-schema-validation`](https://github.com/Player1205/fastify-param-schema-validation)
@@ -568,8 +544,6 @@ middlewares into Fastify plugins
 - [`fastify-postgraphile`](https://github.com/alemagio/fastify-postgraphile)
   Plugin to integrate [PostGraphile](https://postgraphile.org/postgraphile/4/) in
   a Fastify project.
-- [`fastify-postgres-dot-js`](https://github.com/kylerush/fastify-postgresjs) Fastify
-  PostgreSQL connection plugin that uses [Postgres.js](https://github.com/porsager/postgres).
 - [`fastify-prettier`](https://github.com/hsynlms/fastify-prettier) A Fastify
   plugin that uses [prettier](https://github.com/prettier/prettier) under the
   hood to beautify outgoing responses and/or other things in the Fastify server.
@@ -617,8 +591,6 @@ middlewares into Fastify plugins
   using name and parameters.
 - [`fastify-rob-config`](https://github.com/jeromemacias/fastify-rob-config)
   Fastify Rob-Config integration.
-- [`fastify-route-group`](https://github.com/TakNePoidet/fastify-route-group)
-  Convenient grouping and inheritance of routes.
 - [`fastify-route-preset`](https://github.com/inyourtime/fastify-route-preset)
   A Fastify plugin that enables you to create route configurations that can be
   applied to multiple routes.
@@ -626,9 +598,6 @@ middlewares into Fastify plugins
   Ensure the existence of defined S3 buckets on the application startup.
 - [`fastify-schema-constraint`](https://github.com/Eomm/fastify-schema-constraint)
   Choose the JSON schema to use based on request parameters.
-- [`fastify-schema-to-typescript`](https://github.com/thomasthiebaud/fastify-schema-to-typescript)
-  Generate typescript types based on your JSON/YAML validation schemas so they
-  are always in sync.
 - [`fastify-sentry`](https://github.com/alex-ppg/fastify-sentry) Fastify plugin
   to add the Sentry SDK error handler to requests.
 - [`fastify-sequelize`](https://github.com/lyquocnam/fastify-sequelize) Fastify
@@ -639,8 +608,6 @@ middlewares into Fastify plugins
   `fastify-caching`.
 - [`fastify-ses-mailer`](https://github.com/KaranHotwani/fastify-ses-mailer) A
   Fastify plugin for sending emails via AWS SES using AWS SDK v3.
-- [`fastify-shared-schema`](https://github.com/Adibla/fastify-shared-schema) Plugin
-  for sharing schemas between different routes.
 - [`fastify-slow-down`](https://github.com/nearform/fastify-slow-down) A plugin
   to delay the response from the server.
 - [`fastify-split-validator`](https://github.com/MetCoder95/fastify-split-validator)
@@ -665,10 +632,6 @@ middlewares into Fastify plugins
   localhost-only, TLS certificate.
 - [`fastify-totp`](https://github.com/beliven-it/fastify-totp) A plugin to handle
   TOTP (e.g. for 2FA).
-- [`fastify-type-provider-effect-schema`](https://github.com/daotl/fastify-type-provider-effect-schema)
-  Fastify
-  [type provider](https://fastify.dev/docs/latest/Reference/Type-Providers/)
-  for [@effect/schema](https://github.com/Effect-TS/effect).
 - [`fastify-type-provider-zod`](https://github.com/turkerdev/fastify-type-provider-zod)
   Fastify
   [type provider](https://fastify.dev/docs/latest/Reference/Type-Providers/)
@@ -679,10 +642,6 @@ middlewares into Fastify plugins
   request's `user-agent` header.
 - [`fastify-uws`](https://github.com/geut/fastify-uws) A Fastify plugin to
   use the web server [uWebSockets.js](https://github.com/uNetworking/uWebSockets.js).
-- [`fastify-vhost`](https://github.com/patrickpissurno/fastify-vhost) Proxy
-  subdomain HTTP requests to another server (useful if you want to point
-  multiple subdomains to the same IP address, while running different servers on
-  the same machine).
 - [`fastify-vue-plugin`](https://github.com/TheNoim/fastify-vue)
   [Nuxt.js](https://nuxt.com) plugin for Fastify. Control the routes nuxt
   should use.
@@ -725,10 +684,6 @@ middlewares into Fastify plugins
 
 #### [Community Tools](#community-tools)
 
-- [`fast-maker`](https://github.com/imjuni/fast-maker) route configuration
-  generator by directory structure.
-- [`fastify-flux`](https://github.com/Jnig/fastify-flux) Tool for building
-  Fastify APIs using decorators and convert Typescript interface to JSON Schema.
 - [`fastify-intlayer`](https://intlayer.org/doc/environment/fastify)
   i18n solution for error handling, email template
 - [`jeasx`](https://www.jeasx.dev)

package/docs/Reference/Errors.md

@@ -94,7 +94,6 @@
     - [FST_ERR_ROUTE_HANDLER_TIMEOUT_OPTION_NOT_INT](#fst_err_route_handler_timeout_option_not_int)
     - [FST_ERR_ROUTE_REWRITE_NOT_STR](#fst_err_route_rewrite_not_str)
     - [FST_ERR_ROUTE_MISSING_CONTENT_TYPE](#fst_err_route_missing_content_type)
-    - [FST_ERR_ROUTE_MISSING_CONTENT](#fst_err_route_missing_content)
     - [FST_ERR_REOPENED_CLOSE_SERVER](#fst_err_reopened_close_server)
     - [FST_ERR_REOPENED_SERVER](#fst_err_reopened_server)
     - [FST_ERR_PLUGIN_VERSION_MISMATCH](#fst_err_plugin_version_mismatch)
@@ -447,7 +446,6 @@ Below is a table with all the error codes used by Fastify.
 | <a id="fst_err_route_handler_timeout_option_not_int">FST_ERR_ROUTE_HANDLER_TIMEOUT_OPTION_NOT_INT</a> | `handlerTimeout` option must be a positive integer. | Use a positive integer for the `handlerTimeout` option. | - |
 | <a id="fst_err_route_rewrite_not_str">FST_ERR_ROUTE_REWRITE_NOT_STR</a> | `rewriteUrl` needs to be of type `string`. | Use a string for the `rewriteUrl`. | [#4554](https://github.com/fastify/fastify/pull/4554) |
 | <a id="fst_err_route_missing_content_type">FST_ERR_ROUTE_MISSING_CONTENT_TYPE</a> | `Content-Type` header is required for the request. | Send request with `Content-Type` header. | [#6832](https://github.com/fastify/fastify/pull/6832) |
-| <a id="fst_err_route_missing_content">FST_ERR_ROUTE_MISSING_CONTENT</a> | Body is required for the request. | Send request with payload. | [#6832](https://github.com/fastify/fastify/pull/6832) |
 | <a id="fst_err_reopened_close_server">FST_ERR_REOPENED_CLOSE_SERVER</a> | Fastify has already been closed and cannot be reopened. | - | [#2415](https://github.com/fastify/fastify/pull/2415) |
 | <a id="fst_err_reopened_server">FST_ERR_REOPENED_SERVER</a> | Fastify is already started. | - | [#2415](https://github.com/fastify/fastify/pull/2415) |
 | <a id="fst_err_plugin_version_mismatch">FST_ERR_PLUGIN_VERSION_MISMATCH</a> | Installed Fastify plugin mismatched expected version. | Use a compatible version of the plugin. | [#2549](https://github.com/fastify/fastify/pull/2549) |

package/docs/Reference/Reply.md

@@ -340,6 +340,23 @@ to `302` (if status code is not already set by calling `code`).
 > [`encodeurl`](https://www.npmjs.com/package/encodeurl). Invalid URLs will
 > result in a 500 `TypeError` response.
 
+> ⚠️ Security:
+> Encoding alone does **not** prevent open redirects. Neither `encodeURI`
+> nor `encodeurl` escapes `/`, so a caller-supplied target such as
+> `//evil.com` or `/\evil.com` survives encoding and is resolved by the
+> browser as a new host (a protocol-relative, authority-opening
+> reference). When `dest` can be influenced by request input
+> (`req.query`, `req.body`, `req.params`, cookies, or headers), validate
+> that the resolved target is same-origin or on an explicit allowlist
+> instead of relying on encoding:
+>
+> ```js
+> const target = new URL(dest, 'https://your-site.example')
+> if (target.origin !== 'https://your-site.example') {
+>   return reply.code(400).send()
+> }
+> ```
+
 Example (no `reply.code()` call) sets status code to `302` and redirects to
 `/home`
 ```js

package/docs/Reference/Request.md

@@ -122,6 +122,14 @@ to headers on `not found` routes.
 > Schema validation may mutate the `request.headers` and
 > `request.raw.headers` objects, causing the headers to become empty.
 
+> ℹ️ Note:
+> The setter is additive, so it cannot be used to *remove* a header, and a
+> `headers` schema validator's synchronous `{ value }` result is applied through
+> this same setter. `request.headers` is therefore the incoming request's
+> headers (plus any additive values), not a sanitized or authoritative view. If
+> your application needs an allow-listed header subset, build and consume it
+> explicitly from the validated data or from `request.raw.headers`.
+
 ```js
 fastify.post('/:params', options, function (request, reply) {
   console.log(request.body)

package/docs/Reference/Routes.md

@@ -32,7 +32,7 @@ fastify.route(options)
 <a id="options"></a>
 
 * `method`: currently it supports `GET`, `HEAD`, `TRACE`, `DELETE`,
-  `OPTIONS`, `PATCH`, `PUT` and `POST`. To accept more methods,
+  `OPTIONS`, `PATCH`, `PUT`, `POST` and `QUERY`. To accept more methods,
   the [`addHttpMethod`](./Server.md#addHttpMethod) must be used.
   It could also be an array of methods.
 * `url`: the path of the URL to match this route (alias: `path`).
@@ -41,7 +41,7 @@ fastify.route(options)
   [here](./Validation-and-Serialization.md) for more info.
 
   * `body`: validates the body of the request if it is a POST, PUT, PATCH,
-    TRACE, SEARCH, PROPFIND, PROPPATCH or LOCK method.
+    TRACE, SEARCH, PROPFIND, PROPPATCH, LOCK or QUERY method.
   * `querystring` or `query`: validates the querystring. This can be a complete
     JSON Schema object, with the property `type` of `object` and `properties`
     object of parameters, or simply the values of what would be contained in the
@@ -198,6 +198,10 @@ The above route declaration is more *Hapi*-like, but if you prefer an
 
 `fastify.patch(path, [options], handler)`
 
+`fastify.query(path, [options], handler)`
+
+> The `QUERY` method (RFC 10008) requires a `Content-Type` header.
+
 Example:
 ```js
 const opts = {

package/docs/Reference/Server.md

@@ -213,7 +213,7 @@ ignored.
 
 Defines the maximum number of milliseconds for receiving the entire request from
 the client. See [`server.requestTimeout`
-property](https://nodejs.org/dist/latest/docs/api/http.html#servertimeout)
+property](https://nodejs.org/dist/latest/docs/api/http.html#serverrequesttimeout)
 to understand the effect of this option.
 
 When `serverFactory` option is specified, this option is ignored.
@@ -1046,7 +1046,7 @@ be invoked.
 
 This can be useful especially if you have a regex-based route, protecting you
 against [ReDoS
-attacks](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS).
+attacks](https://community.owasp.org/attacks/Regular_expression_Denial_of_Service_-_ReDoS).
 
 
 ### `onBadUrl`

package/docs/Reference/Validation-and-Serialization.md

@@ -167,6 +167,22 @@ parameters at the top level.
 > ℹ For using the latest Ajv (v8), refer to the
 > [`schemaController`](./Server.md#schema-controller) section.
 
+##### Header name case
+
+Node.js exposes request header names in lowercase. Fastify normalizes header
+names in a `headers` schema to lowercase before compilation, so assertions
+written in the canonical header-name case still match the request, for example
+`required: ['X-Api-Key']`, `dependencies`, and a `propertyNames` deny-list that
+uses `enum` or `const`.
+
+Regular-expression constraints on header names are the exception. A
+`patternProperties` key and a `propertyNames` `pattern` are regular expressions
+matched against the already-lowercased header names, and Fastify cannot safely
+rewrite a regular expression. Author them to match lowercase (for example
+`^x-debug-.*$`, not `^X-Debug-.*$`) or make them case-insensitive. A pattern
+written in canonical case will not match, and the assertion it guards will not
+apply.
+
 Example:
 ```js
 const bodyJsonSchema = {
@@ -639,6 +655,23 @@ an application.
 > failure by rejecting (throwing), and it cannot coerce the request part through
 > a resolved `value`.
 
+##### `headers` and the `{ value }` result
+
+For the `headers` part specifically, the synchronous success `value` is applied
+through the additive [`request.headers`](./Request.md#headers) setter. That
+setter *adds or overrides* headers on top of the raw request headers; it does
+**not** replace them. Raw request headers remain separately available as
+`request.raw.headers`, and any incoming header that is not present in the
+returned `value` is still visible on `request.headers`.
+
+Consequently, a synchronous custom `headers` validator cannot remove a header by
+simply omitting it from `value`. The same applies to the default Ajv validator:
+`request.headers` is the incoming request's headers (plus any additive values)
+and is not a sanitized, authoritative view. If your application needs a
+sanitized or allow-listed header view — for example to drive an authorization
+decision — build and consume that view explicitly from the validated data rather
+than re-reading `request.headers`.
+
 ##### .statusCode property
 
 All validation errors have a `.statusCode` property set to `400`, ensuring the

package/docs/Reference/Warnings.md

@@ -10,6 +10,7 @@
   - [Fastify Security Codes](#fastify-security-codes)
     - [FSTSEC001](#FSTSEC001)
     - [FSTSEC002](#FSTSEC002)
+    - [FSTSEC003](#FSTSEC003)
   - [Fastify Deprecation Codes](#fastify-deprecation-codes)
 
 ## Warnings
@@ -51,6 +52,7 @@ Disabling warnings is not recommended and may cause unexpected behavior.
 | ---- | ----------- | ------------ | ---------- |
 | <a id="FSTSEC001">FSTSEC001</a> | A `RegExp` Content-Type is used that may be vulnerable to a CORS bypass, because it does not anchor the essence MIME type. | Start the `RegExp` with `^` or include `;?` so the essence MIME type is detected correctly. | [#4450](https://github.com/fastify/fastify/pull/4450) |
 | <a id="FSTSEC002">FSTSEC002</a> | A headers schema references an external `$ref` (a schema registered with `addSchema`) that is not reached by header case normalization. Header names in the referenced schema keep their original case and do not match the lowercased request headers, so case-insensitive assertions such as `required` and `dependencies` may not apply. | Inline the header schema instead of referencing it with an external `$ref`. | - |
+| <a id="FSTSEC003">FSTSEC003</a> | A headers schema uses a `$ref` inside `propertyNames` that is not reached by header case normalization. Header names held in the referenced schema keep their original case and do not match the lowercased request headers, so a case-insensitive deny-list or allow-list on header names may not apply. | Inline the `propertyNames` constraint instead of referencing it with a `$ref`. | - |
 
 ### Fastify Deprecation Codes
 

package/lib/content-type-parser.js

@@ -253,12 +253,12 @@ function rawBody (request, reply, options, parser, done) {
   }
 
   let receivedLength = 0
-  let body = asString ? '' : []
+  const chunks = []
   const payload = request[kRequestPayloadStream] || request.raw
 
-  if (asString) {
-    payload.setEncoding('utf8')
-  }
+  // Always read raw Buffers and decode once at the end: setEncoding() would
+  // allocate a StringDecoder per request and force a Buffer.byteLength()
+  // rescan of every decoded chunk just to enforce the byte limit.
 
   payload.on('data', onData)
   payload.on('end', onEnd)
@@ -266,7 +266,11 @@ function rawBody (request, reply, options, parser, done) {
   payload.resume()
 
   function onData (chunk) {
-    receivedLength += asString ? Buffer.byteLength(chunk) : chunk.length
+    // A custom preParsing stream may still emit strings
+    if (typeof chunk === 'string') {
+      chunk = Buffer.from(chunk)
+    }
+    receivedLength += chunk.length
     const { receivedEncodedLength = 0 } = payload
     // The resulting body length must not exceed bodyLimit (see "zip bomb").
     // The case when encoded length is larger than received length is rather theoretical,
@@ -279,11 +283,7 @@ function rawBody (request, reply, options, parser, done) {
       return
     }
 
-    if (asString) {
-      body += chunk
-    } else {
-      body.push(chunk)
-    }
+    chunks.push(chunk)
   }
 
   function onEnd (err) {
@@ -304,8 +304,17 @@ function rawBody (request, reply, options, parser, done) {
       return
     }
 
-    if (!asString) {
-      body = Buffer.concat(body)
+    let body
+    if (asString) {
+      // Decoding the whole body at once also keeps multi-byte characters
+      // split across chunks intact
+      body = chunks.length === 1
+        ? chunks[0].toString('utf8')
+        : Buffer.concat(chunks, receivedLength).toString('utf8')
+    } else {
+      // Always copy so the parser never receives a view over the shared
+      // socket read buffer
+      body = Buffer.concat(chunks, receivedLength)
     }
 
     const result = parser.fn(request, body, done)

package/lib/content-type.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const { LruMap: Lru } = require('toad-cache')
+const { FifoMap: Fifo } = require('toad-cache')
 
 /**
  * keyValuePairsReg matches a single `parameter-name "=" parameter-value`
@@ -61,9 +61,9 @@ const subtypeNameReg = /^[\w!#$%&'*+.^`|~-]+\s*$/
 
 /**
  * Content-Type internal shared cache
- * @type {Lru<ContentType>}
+ * @type {Fifo<ContentType>}
  */
-const cache = new Lru(100)
+const cache = new Fifo(100)
 
 /**
  * ContentType parses and represents the value of the content-type header.
@@ -82,7 +82,7 @@ class ContentType {
   /**
    * The shared cache of ContentType instances. The cache is used to avoid
    * creating multiple instances of ContentType for the same header value.
-   * @type {Lru<ContentType>}
+   * @type {Fifo<ContentType>}
    */
   static get cache () { return cache }
 

package/lib/errors.js

@@ -466,11 +466,6 @@ const codes = {
     "Method '%s' must provide a 'Content-Type' header.",
     400
   ),
-  FST_ERR_ROUTE_MISSING_CONTENT: createError(
-    'FST_ERR_ROUTE_MISSING_CONTENT',
-    "Method '%s' must provide a request body.",
-    400
-  ),
 
   /**
    *  again listen when close server

package/lib/handle-request.js

@@ -6,8 +6,7 @@ const { validate: validateSchema } = require('./validation')
 const { preValidationHookRunner, preHandlerHookRunner } = require('./hooks')
 const {
   FST_ERR_CTP_INVALID_MEDIA_TYPE,
-  FST_ERR_ROUTE_MISSING_CONTENT_TYPE,
-  FST_ERR_ROUTE_MISSING_CONTENT
+  FST_ERR_ROUTE_MISSING_CONTENT_TYPE
 } = require('./errors')
 const { setErrorStatusCode } = require('./error-status')
 const {
@@ -51,20 +50,15 @@ function handleRequest (err, request, reply) {
         reply.status(400).send(new FST_ERR_ROUTE_MISSING_CONTENT_TYPE(method))
         return
       }
-
-      if (isEmptyBody(headers)) {
-        // https://datatracker.ietf.org/doc/html/rfc10008#section-2
-        // Servers MUST fail the request if the Content-Type request field
-        // ([HTTP], Section 8.3) is missing or is inconsistent with the
-        // request content.
-        reply[kReplyIsError] = true
-        reply.status(400).send(new FST_ERR_ROUTE_MISSING_CONTENT(method))
-        return
-      }
     }
 
     if (ctHeader === undefined) {
-      if (isEmptyBody(headers)) {
+      const contentLength = headers['content-length']
+      const transferEncoding = headers['transfer-encoding']
+      const isEmptyBody = transferEncoding === undefined &&
+        (contentLength === undefined || contentLength === '0')
+
+      if (isEmptyBody) {
         // Request has no body to parse
         handler(request, reply)
         return
@@ -109,13 +103,6 @@ function handler (request, reply) {
   }
 }
 
-function isEmptyBody (headers) {
-  const contentLength = headers['content-length']
-  const transferEncoding = headers['transfer-encoding']
-  return transferEncoding === undefined &&
-    (contentLength === undefined || contentLength === '0')
-}
-
 function preValidationCallback (err, request, reply) {
   if (reply.sent === true) return
 

package/lib/reply.js

@@ -95,7 +95,7 @@ Object.defineProperties(Reply.prototype, {
   },
   mediaType: {
     get () {
-      const contentTypeHeader = this[kReplyHeaders]['content-type']
+      const contentTypeHeader = this.getHeader('content-type')
       return ContentType.from(contentTypeHeader).mediaType
     }
   },
@@ -284,6 +284,10 @@ Reply.prototype.header = function (key, value = '') {
     } else {
       this[kReplyHeaders][key].push(value)
     }
+  } else if (key === 'set-cookie' && Array.isArray(value)) {
+    // Copy the array: later calls push into the stored one, and the caller's
+    // array (often a module-level constant) must not grow across requests.
+    this[kReplyHeaders][key] = value.slice()
   } else {
     this[kReplyHeaders][key] = value
   }
@@ -370,7 +374,7 @@ Reply.prototype.getSerializationFunction = function (schemaOrStatus, contentType
   return serialize
 }
 
-Reply.prototype.compileSerializationSchema = function (schema, httpStatus = null, contentType = null) {
+Reply.prototype.compileSerializationSchema = function (schema, httpStatus, contentType) {
   const { request } = this
   const { method, url } = request
 

package/lib/request.js

@@ -122,8 +122,10 @@ function buildRequestWithTrustProxy (R, trustProxy) {
     host: {
       get () {
         const socket = this.raw.socket
-        if (this.headers['x-forwarded-host'] && socket != null && proxyFn(socket.remoteAddress, 0)) {
-          return getLastEntryInMultiHeaderValue(this.headers['x-forwarded-host'])
+        // The headers getter may allocate a new object, so read it once.
+        const headers = this.headers
+        if (headers['x-forwarded-host'] && socket != null && proxyFn(socket.remoteAddress, 0)) {
+          return getLastEntryInMultiHeaderValue(headers['x-forwarded-host'])
         }
         /**
          * The last fallback supports the following cases:
@@ -131,14 +133,16 @@ function buildRequestWithTrustProxy (R, trustProxy) {
          * 2. HTTP/1.0 without a Host Header
          * 3. Headers schema that may remove the Host Header
          */
-        return this.headers.host ?? this.headers[':authority'] ?? ''
+        return headers.host ?? headers[':authority'] ?? ''
       }
     },
     protocol: {
       get () {
         const socket = this.raw.socket
-        if (this.headers['x-forwarded-proto'] && socket != null && proxyFn(socket.remoteAddress, 0)) {
-          return getLastEntryInMultiHeaderValue(this.headers['x-forwarded-proto'])
+        // The headers getter may allocate a new object, so read it once.
+        const headers = this.headers
+        if (headers['x-forwarded-proto'] && socket != null && proxyFn(socket.remoteAddress, 0)) {
+          return getLastEntryInMultiHeaderValue(headers['x-forwarded-proto'])
         }
         if (this.socket) {
           return this.socket.encrypted ? 'https' : 'http'

package/lib/route.js

@@ -466,8 +466,12 @@ function buildRouting (options) {
       // the child logger creation altogether
       childLogger = logger
     } else {
-      const loggerOpts = {
-        level: context.logLevel
+      const loggerOpts = {}
+
+      // An empty level means "inherit". Passing it would make pino treat it
+      // as a level change and rebuild every log method of each request child.
+      if (context.logLevel) {
+        loggerOpts.level = context.logLevel
       }
 
       if (context.logSerializers) {