Skip to content

🚨 [security] Update fastify 5.8.5 → 5.12.1 (minor) - #82

Open
depfu[bot] wants to merge 1 commit into
mainfrom
depfu/update/pnpm/fastify-5.12.1
Open

🚨 [security] Update fastify 5.8.5 → 5.12.1 (minor)#82
depfu[bot] wants to merge 1 commit into
mainfrom
depfu/update/pnpm/fastify-5.12.1

Conversation

@depfu

@depfu depfu Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ fastify (5.8.5 → 5.12.1) · Repo

Security Advisories 🚨

🚨 fastify vulnerable to schema validation bypass via root primitive coercion mismatch

Impact

fastify before 5.12.1, when a route uses a root-level primitive body schema (for example an integer with a minimum and maximum) and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body "10" is coerced to the number 10 and passes an integer 1 to 10 schema, but request.body stays the string "10". An application that trusts the validated type is handed a value that did not satisfy the schema, which can bypass limits the application enforces on that typed value. Object and array body schemas are not affected, they coerce their members in place.

Patches

Upgrade to fastify 5.12.1.

Workarounds

Until you can upgrade, avoid relying on the validated type of a root primitive body. Wrap the value in an object schema (object properties are coerced in place), for example accept { "value": 10 } and read request.body.value, or re-check the type in the handler.

🚨 fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

Impact

The fix for CVE-2026-3635 (GHSA-444r-cwp2-x5xf) added a proxyFn(socket.remoteAddress, 0) guard on the X-Forwarded-* reads in request.host, request.protocol, request.hostname, request.ip, and request.ips. That guard closes the IP, CIDR, and custom-function forms of trustProxy correctly because those forms compile to predicates that inspect the connecting address. The hop-count form (trustProxy: <number>) compiles to a predicate that structurally ignores the address argument, so the guard reduces to 0 < tp, always true for any tp >= 1.

Applications configured with trustProxy: <number> (documented as "behind N reverse proxies", trustProxy: 1 being the canonical single-proxy setting) remain vulnerable. An attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, can spoof the request fields exactly as in the unpatched version. Impact class matches the parent CVE-2026-3635: host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie / CSRF-origin bypass, host-based routing and cache poisoning.

Patches

Patched in fastify 5.12.1. The numeric form of trustProxy is now disabled at runtime and removed from the TypeScript type union.

Workarounds

  • Migrate to an IP / CIDR / custom-function trustProxy value that validates the connecting address. Custom functions must inspect the address argument, not only the hop index.
  • Ensure the Fastify origin is only reachable through the trusted proxy chain (no direct network path).
Release Notes

5.12.1

⚠️ Security release

What's Changed

  • [Backport 5.x] test: fix reply.mediaType by @github-actions[bot] in #6950
  • [Backport 5.x] ci: allow backport in pr title by @github-actions[bot] in #6952
  • [Backport 5.x] fix: run preClose hook exactly once per declaring instance by @github-actions[bot] in #6954
  • [Backport 5.x] fix: report canonical route url for hidden prefix slash route by @github-actions[bot] in #6961

Full Changelog: v5.12.0...v5.12.1

5.12.0

What's Changed

  • chore(sponsor): add testmu ai by @Eomm in #6922
  • docs: add per-route logging for Google Cloud Functions by @slegarraga in #6907
  • test: remove @sinonjs/fake-timers by @climba03003 in #6934
  • [Backport 5.x] fix: remove raw response headers by @github-actions[bot] in #6939
  • [Backport 5.x] test: use process-warning spyWarning for testing by @github-actions[bot] in #6945
  • [Backport 5.x] feat: add Reply.prototype.mediaType by @github-actions[bot] in #6946
  • [Backport 5.x] fix(content-type): return undefined for invalid media types by @github-actions[bot] in #6947

Full Changelog: v5.11.3...v5.12.0

5.11.3

What's Changed

  • fix: clear trailer state when removing all trailers by @Ram-blip in #6845
  • docs: document percent-decoded route params as untrusted input by @mcollina in #6903
  • docs(errors): document what the default error handler sends by @basteez in #6894
  • docs(readme): fix grammar and cjs capitalization by @minirang in #6899
  • fix: pass null instead of undefined to requestCompleted on success by @lazerg in #6837
  • docs(encapsulation): clarify nested plugin scopes by @jean-michelet in #6893
  • chore: Bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @dependabot[bot] in #6916
  • chore: Bump fastify/workflows/.github/workflows/nested-quality.yml from 6.0.0 to 7.0.0 by @dependabot[bot] in #6917
  • fix: recognize constructor-assigned built-in properties as decorator … by @aquie00t in #6892
  • fix: reset lastIndex before testing global/sticky content-type RegExp parsers by @zelinewang in #6846

New Contributors

Full Changelog: v5.11.2...v5.11.3

5.11.2

What's Changed

  • fix fastify version in fastify.js

Full Changelog: v5.11.1...v5.11.2

5.11.1

What's Changed

  • fix: add http method override warning by @jean-michelet in #6879
  • fix(types): allow explicit http2: false in server options by @Tony133 in #6888
  • docs: clarify what attachValidation exposes on request.validationError by @basteez in #6891
  • fix: do not force close in-flight connections when forceCloseConnections is 'idle' by @aquie00t in #6889

New Contributors

Full Changelog: v5.11.0...v5.11.1

5.11.0

What's Changed

New Contributors

Full Changelog: v5.10.0...v5.11.0

5.10.0

What's Changed

  • docs(type-providers): clarify as const usage by @smith558 in #6772
  • docs: fix broken and redirected links by @Eomm in #6817
  • docs: remove marko from @fastify/view engines (support dropped) by @EduardF1 in #6821
  • fix: clear socket._meta on reply.hijack() when onTimeout is registered by @nerkoux in #6810
  • docs: fix duplicate routeOptions entries in Request.md example by @thePranav-kpk in #6824
  • chore: Bump @types/node from 25.9.4 to 26.0.1 in the dev-dependencies-typescript group by @dependabot[bot] in #6829
  • docs(ecosystem): add @stitchapi/fastify to Community plugins by @rejifald in #6820
  • feat: introduce log controller layer by @Eomm in #6580
  • fix: use ContentType to detect json and charset in reply.send by @climba03003 in #6830
  • docs: fix incorrect defaults and code examples in Server.md by @Adit-Jain-srm in #6805
  • docs: fix incorrect hook count in Hooks.md by @thePranav-kpk in #6825
  • chore: Bump fast-json-stringify from 6.4.0 to 7.0.0 in the dependencies group across 1 directory by @dependabot[bot] in #6800
  • perf: reduce per-request overhead in the request lifecycle by @mcollina in #6831
  • fix: derive request.port from request.host by @mcollina in #6680
  • docs: update Logging.md with per-route log level info by @asppsa in #6627
  • docs(type-providers): update import for article consistency by @smith558 in #6771

New Contributors

Full Changelog: v5.9.0...v5.10.0

5.9.0

What's Changed

  • feat: add request.mediaType by @climba03003 in #6653
  • docs: remove deprecated leveldb plugin and update ecosystem by @Tony133 in #6661
  • chore(sponsor): add bestforandroid by @Eomm in #6659
  • ci: drop Node.js 20 from yarn matrix in package-manager-ci.yml by @Tony133 in #6662
  • fix: prevent duplicate res.end in sendTrailer with sync callbacks by @climba03003 in #6676
  • fix: avoid duplicate closeIdleConnections call on native servers by @trivikr in #6669
  • fix: error.code not present on some routing errors by @mcollina in #6678
  • fix: correct isCustomSerializerCompiler flag check by @eddieran in #6657
  • fix: validate invalid route logLevel at registration by @maxpetrusenko in #6523
  • docs: update contribution rules by @Tony133 in #6670
  • fix: use ContentType parser for response schema lookup by @UlisesGascon in #6685
  • ci(ci): use shared quality workflow by @Fdawgs in #6688
  • fix(types): allow request.getValidationFunction() to return undefined by @trivikr in #6665
  • fix: do not trust forwarded host/proto when socket is missing by @mcollina in #6684
  • perf: defer ContentType parsing in getSchemaSerializer until needed by @aquie00t in #6692
  • perf: cache parsed ContentType objects in ContentTypeParser by @aquie00t in #6694
  • perf: add typeof guard before toString.call in send and onSendEnd by @aquie00t in #6693
  • chore: Bump pnpm/action-setup from 5.0.0 to 6.0.4 by @dependabot[bot] in #6704
  • chore: Bump actions/github-script from 8 to 9 by @dependabot[bot] in #6705
  • chore: Bump JustinBeckwith/linkinator-action from 2.4.0 to 2.4.2 by @dependabot[bot] in #6706
  • docs: correct return503OnClosing comment in route.js by @mcollina in #6712
  • fix: enable diagnostics tracking for async error handlers by @irzix in #6458
  • fix: ignore duplicate trailer completions by @mcollina in #6714
  • feat: add support of onMaxParamLength by @climba03003 in #6716
  • chore: introduce TSTyche for type testing by @mrazauskas in #6532
  • docs(reference): grammar and readability fixes by @Fdawgs in #6710
  • chore: update depedabot setting by @climba03003 in #6715
  • fix: include hint and docs URL in FSTWRN004 warning message by @aquie00t in #6723
  • ci(ci): do not pass secrets to reusable workflow by @Fdawgs in #6744
  • docs: add fastify-intlayer to ecosystem documentation by @aymericzip in #6594
  • chore: Bump concurrently from 9.2.1 to 10.0.0 by @dependabot[bot] in #6752
  • docs(Errors): fix incorrect usage of root fastify inside plugin scope by @Rpaudel379 in #6731
  • ci: add node 26 to test matrices by @Fdawgs in #6728
  • docs(Warnings): remove retired FSTWRN002 warning code by @leestana01 in #6754
  • fix: chunk large HTTP/2 buffer replies by @mcollina in #6746
  • chore: migrate type tests to TSTyche assertions (part one) by @mrazauskas in #6726
  • chore: migrate type tests to TSTyche assertions (part two) by @mrazauskas in #6727
  • docs: fix doubled braces in serializerCompiler signature by @DucMinhNe in #6747
  • docs: remove HackerOne reporting link by @jhcpeixoto in #6735
  • refactor(decorate): replace find with some in hasKey for correct boolean semantics by @aquie00t in #6759
  • fix: replace AssertionError with FST_ERR_PLUGIN_DEPENDENCY_NOT_REGISTERED in checkDependencies by @aquie00t in #6774
  • docs(ecosystem): add @inferdi/fastify by @maxrendel in #6742
  • docs(typo): Write-Plugin.md by @zakirimadullahprogrammer-tech in #6776
  • docs: fix duplicate anchor IDs causing broken TOC links by @AliMahmoudDev in #6770
  • docs: add fastify-ata as a JSON Schema validator option by @mertcanaltin in #6733
  • chore: rename type test files by @mrazauskas in #6762
  • docs: update ajv-errors guidance by @Herrtian in #6741
  • chore(warnings): correct duplicate 'not' typos in inline comments by @mixelburg in #6713
  • docs: add fastify-param-schema-validation to ecosystem by @Player1205 in #6760
  • docs(ecosystem): add @thecodepace/fastify-http-query by @Puppo in #6785
  • chore: Bump esbuild from 0.25.12 to 0.28.1 in /test/bundler/esbuild in the npm_and_yarn group across 1 directory by @dependabot[bot] in #6788
  • fix: clear socket._meta after response to prevent keep-alive leaks by @nerkoux in #6799
  • fix: avoid double slash when joining nested prefixes by @rohithvegesna in #6803
  • docs(sponsors): Update sponsors list by removing two entries by @Eomm in #6792
  • chore: Bump fastify-plugin from 5.1.0 to 6.0.0 by @dependabot[bot] in #6801
  • chore(package.json): fix delvedor's personal url by @Fdawgs in #6808
  • chore: replace http with https in urls by @Fdawgs in #6809
  • chore: add new sponsor by @Eomm in #6813
  • chore: Bump actions/checkout from 6 to 7 by @dependabot[bot] in #6812
  • fix: hasRequestDecorator/hasReplyDecorator misses constructor-assigned built-in properties by @LeSingh1 in #6753
  • docs: migrate Zod type provider to official @fastify package by @Tony133 in #6686
  • docs: add warning about empty string coercion with nullable types by @ritambh888 in #6452
  • docs: fix incorrect code examples in Hooks and Server reference by @rrodj in #6622
  • docs: update Serverless guide Dockerfile to a supported Node.js version by @harish885 in #6789
  • docs(types): mark request metadata accessors as untrusted input by @mcollina in #6572
  • Bumped v5.9.0 by @Eomm in #6816

New Contributors

Full Changelog: v5.8.5...v5.9.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu Bot added the depfu label Sep 2, 2026
@depfu
depfu Bot requested a review from microwavekonijn September 2, 2026 16:07
@changeset-bot

changeset-bot Bot commented Sep 2, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 6cf6e07

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@microwavekonijn microwavekonijn Awaiting requested review from microwavekonijn

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants