fastify
fastify (latest known version: 5.10.0) has 9 known breaking changes on record, each backed by a source URL.
Security advisories
Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header
Fastify: Incorrect Content-Type parsing can lead to CSRF attack
fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections
fastify vulnerable to denial of service via malicious Content-Type
Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation
Fastify's Content-Type header tab character allows body validation bypass
Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass
Denial of Service vulnerability with large JSON payloads in fastify
Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream
Recent changes
* feat!: Add req.hostname and req.port by @aarontravass in https://github.com/fastify/fastify/pull/4766
* refactor!: remove json shorthand by @climba03003 in https://github.com/fastify/fastify/pull/5586
* refactor!: remove json shorthand by @climba03003 in https://github.com/fastify/fastify/pull/5586
* feat!: Add req.hostname and req.port by @aarontravass in https://github.com/fastify/fastify/pull/4766
Version 4.0.0 is a semver-major release over 3.29.5, but no breaking change was detected in the release notes text - flagged for manual review.
⚠️ When updating your application to Fastify v3, update all the module at once. There might be incompatibilities by trying to do them "one at a time".
For security reasons we changed the default in the `ajv`configuration. Unfortunately `allErrors: true` is a DoS attack vector for certain schemas. So this changed to `allErrors: false`. See: ajv-validator/ajv@334071a Ref: https://hackerone.com/reports/903521
Version 2.0.0 is a semver-major release over 1.14.6, but no breaking change was detected in the release notes text - flagged for manual review.
Version 1.0.0 is a semver-major release over 0.43.0, but no breaking change was detected in the release notes text - flagged for manual review.
Check what changed for fastify since your installed version, live.
Open the playground →