fix(deps): update dependency fastify to v5 [security] #7913
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
renovate
bot
added
dependencies
![kodiakhq[bot]](https://avatars.githubusercontent.com/in/29196?s=60&v=4){kind=small}
serhalp
reviewed
Feb 3, 2026
| "extract-zip": "2.0.1", | ||
| "fastest-levenshtein": "1.0.16", | ||
| "fastify": "4.29.1", | ||
| "fastify": "5.7.3", |
Member
There was a problem hiding this comment.
These are lousy release notes, but looks good 👍🏼: https://github.com/fastify/fastify/releases/tag/v5.0.0
Member
There was a problem hiding this comment.
We only use fastify for the static file server, and we pretty much just create the server and start it.
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
serhalp
reviewed
Feb 3, 2026
| }, | ||
| "dependencies": { | ||
| "@fastify/static": "7.0.4", | ||
| "@fastify/static": "9.0.0", |
Member
There was a problem hiding this comment.
Also quite lousy release notes but looks fine (this is needed to support the fastify@5 bump):
- https://github.com/fastify/fastify-static/releases/tag/v8.0.0
- this bumps its glob to v11, which bumps to node >=20 (build(deps): bump glob from 10.4.5 to 11.0.0 fastify/fastify-static#456), which is fine
- this indirectly bumps to node >=18 (build(deps): bump content-disposition from 0.5.4 to 1.0.1 fastify/fastify-static#547), which is fine
- https://github.com/fastify/fastify-static/releases/tag/v9.0.0
- this indirectly bumps to glob@13, which is also fine (great, actually): https://github.com/isaacs/node-glob/blob/main/changelog.md
Bonus: this shaves 20 transitive deps and ~700 KB.
serhalp
reviewed
Feb 3, 2026
| "path-scurry": "^2.0.0" | ||
| }, | ||
| "engines": { | ||
| "node": "20 || >=22" |
serhalp
reviewed
Feb 3, 2026
| "integrity": "sha512-vFrFJkWtJvJnD5hg+hJvVE8Lh/TcMzKnTgCWmtBipwI5yLX/iX+5UB2tfuyODF5E7k9xEzMdYgGqaSb1c0c5Yw==", | ||
| "license": "BlueOak-1.0.0", | ||
| "engines": { | ||
| "node": "20 || >=22" |
serhalp
reviewed
Feb 3, 2026
| "@isaacs/brace-expansion": "^5.0.0" | ||
| }, | ||
| "engines": { | ||
| "node": "20 || >=22" |
serhalp
reviewed
Feb 3, 2026
| "integrity": "sha512-yzMTt9lEb8Gv7zRioUilSglI0c0smZ9k5D65677DLWLtWJaXIS3CqcGyUFByYKlnUj6TkjLVs54fBl6+TiGQDQ==", | ||
| "license": "MIT", | ||
| "engines": { | ||
| "node": "20 || >=22" |
serhalp
reviewed
Feb 3, 2026
| "@isaacs/balanced-match": "^4.0.1" | ||
| }, | ||
| "engines": { | ||
| "node": "20 || >=22" |
serhalp
reviewed
Feb 3, 2026
| "real-require": "^0.2.0" | ||
| }, | ||
| "engines": { | ||
| "node": ">=20" |
serhalp
reviewed
Feb 3, 2026
| }, | ||
| "engines": { | ||
| "node": ">=14" | ||
| "node": ">=20" |
serhalp
reviewed
Feb 3, 2026
| "integrity": "sha512-oIXISMynqSqm241k6kcQ5UwttDILMK4BiurCfGEREw6+X9jkkpEe5T9FZaApyLGGOnFuyMWZpdolTXMtvEJ08Q==", | ||
| "license": "MIT", | ||
| "engines": { | ||
| "node": ">=18" |
serhalp
approved these changes
Feb 3, 2026
just `npm audit fix --omit=dev`
eduardoboucas
approved these changes
Feb 3, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.29.1→5.7.3GitHub Vulnerability Alerts
CVE-2026-25224
Impact
A Denial of Service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a
ReadableStream(orResponsewith a Web Stream body) viareply.send()are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation.Patches
The issue is fixed in Fastify 5.7.3. Users should upgrade to 5.7.3 or later.
Workarounds
Avoid sending Web Streams from Fastify responses (e.g.,
ReadableStreamorResponsebodies). Use Node.js streams (stream.Readable) or buffered payloads instead until the project can upgrade.References
CVE-2026-25223
Impact
A validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (
\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type.For example, a request with
Content-Type: application/json\tawill bypass JSON schema validation but still be parsed as JSON.This vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints. The concrete impact depends on the handler implementation and the level of trust placed in the validated request body, but at the library level, this allows complete bypass of body validation for any handler using Content-Type-discriminated schemas.
This issue is a regression or missed edge case from the fix for a previously reported vulnerability.
Patches
This vulnerability has been patched in Fastify v5.7.2. All users should upgrade to this version or later immediately.
Workarounds
If upgrading is not immediately possible, user can implement a custom
onRequesthook to reject requests containing tab characters in the Content-Type header:Resources
Release Notes
fastify/fastify (fastify)
v5.7.3Compare Source
CVE-2026-25224.What's Changed
Full Changelog: fastify/fastify@v5.7.2...v5.7.3
v5.7.2Compare Source
Parsing of the
content-typeheader has been improved to a strict parser in PR #6414. This means only header values in the form described in RFC 9110 are accepted.What's Changed
New Contributors
Full Changelog: fastify/fastify@v5.7.1...v5.7.2
v5.7.1Compare Source
What's Changed
Full Changelog: fastify/fastify@v5.7.0...v5.7.1
v5.7.0Compare Source
What's Changed
New Contributors
Full Changelog: fastify/fastify@v5.6.2...v5.7.0
v5.6.2Compare Source
v5.6.1Compare Source
What's Changed
New Contributors
Full Changelog: fastify/fastify@v5.6.0...v5.6.1
v5.6.0Compare Source
What's Changed
New Contributors
Full Changelog: fastify/fastify@v5.5.0...v5.6.0
v5.5.0Compare Source
What's Changed
New Contributors
Full Changelog: fastify/fastify@v5.4.0...v5.5.0
v5.4.0Compare Source
What's Changed
Full Changelog: fastify/fastify@v5.3.3...v5.4.0
v5.3.3Compare Source
What's Changed
setErrorHandleroverriding a previously defined error handler on an encapsulated context by @jean-michelet in #6097fastify-diagnostics-channelby @inyourtime in #6117New Contributors
Full Changelog: fastify/fastify@v5.3.2...v5.3.3
v5.3.2Compare Source
Unfortunately, v5.3.1 did not include a complete fix for "Invalid content-type parsing could lead to validation bypass" and CVE-2025-32442. This is a follow-up patch to cover an edge case.
What's Changed
New Contributors
Full Changelog: fastify/fastify@v5.3.1...v5.3.2
v5.3.1Compare Source
What's Changed
New Contributors
Full Changelog: fastify/fastify@v5.3.0...v5.3.1
v5.3.0Compare Source
What's Changed
[kState].readyPromisefor garbage collection by @LiviaMedeiros in #6030New Contributors
Full Changelog: fastify/fastify@v5.2.2...v5.3.0
v5.2.2Compare Source
What's Changed
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.