chore(deps): update dependency fastify to v5 [security] - #37

Details

Impact

A validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type.

For example, a request with Content-Type: application/json\ta will bypass JSON schema validation but still be parsed as JSON.

This vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints. The concrete impact depends on the handler implementation and the level of trust placed in the validated request body, but at the library level, this allows complete bypass of body validation for any handler using Content-Type-discriminated schemas.

This issue is a regression or missed edge case from the fix for a previously reported vulnerability.

Patches

This vulnerability has been patched in Fastify v5.7.2. All users should upgrade to this version or later immediately.

Workarounds

If upgrading is not immediately possible, user can implement a custom onRequest hook to reject requests containing tab characters in the Content-Type header:

fastify.addHook('onRequest', async (request, reply) => {
  const contentType = request.headers['content-type']
  if (contentType && contentType.includes('\t')) {
    reply.code(400).send({ error: 'Invalid Content-Type header' })
  }
})

Resources

• https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272
• https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125
• Fastify Validation and Serialization Documentation
• https://hackerone.com/reports/3464114

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq
• https://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821
• https://hackerone.com/reports/3464114
• https://fastify.dev/docs/latest/Reference/Validation-and-Serialization
• https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125
• https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272
• https://nvd.nist.gov/vuln/detail/CVE-2026-25223
• https://github.com/advisories/GHSA-jx2c-rxcm-jvmq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

A Denial of Service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation.

Patches

The issue is fixed in Fastify 5.7.3. Users should upgrade to 5.7.3 or later.

Workarounds

Avoid sending Web Streams from Fastify responses (e.g., ReadableStream or Response bodies). Use Node.js streams (stream.Readable) or buffered payloads instead until the project can upgrade.

References

• https://hackerone.com/reports/3524779

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/fastify/fastify/security/advisories/GHSA-mrq3-vjjr-p77c
• https://github.com/fastify/fastify/commit/eb11156396f6a5fedaceed0140aed2b7f026be37
• https://hackerone.com/reports/3524779
• https://nvd.nist.gov/vuln/detail/CVE-2026-25224
• https://github.com/advisories/GHSA-mrq3-vjjr-p77c

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Summary

When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.

Affected Versions

fastify <= 5.8.2

Impact

Applications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.

When trustProxy: true (trust everything), both host and protocol trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf
• https://nvd.nist.gov/vuln/detail/CVE-2026-3635
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.8.3
• https://www.cve.org/CVERecord?id=CVE-2026-3635
• https://github.com/advisories/GHSA-444r-cwp2-x5xf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

fastify before 5.12.1, when a route uses a root-level primitive body schema (for example an integer with a minimum and maximum) and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body "10" is coerced to the number 10 and passes an integer 1 to 10 schema, but request.body stays the string "10". An application that trusts the validated type is handed a value that did not satisfy the schema, which can bypass limits the application enforces on that typed value. Object and array body schemas are not affected, they coerce their members in place.

Patches

Upgrade to fastify 5.12.1.

Workarounds

Until you can upgrade, avoid relying on the validated type of a root primitive body. Wrap the value in an object schema (object properties are coerced in place), for example accept { "value": 10 } and read request.body.value, or re-check the type in the handler.

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-w2qp-rph6-63g4
• https://nvd.nist.gov/vuln/detail/CVE-2026-18504
• https://github.com/fastify/fastify/commit/1ef8a60c87e94f42f666aa15ad68957772a83655
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.1
• https://github.com/advisories/GHSA-w2qp-rph6-63g4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

Fastify decided whether to validate a request part by checking its schema for JavaScript truthiness. JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance, but because false is falsy, a route that set body, querystring, params, or headers to false had that part left uncompiled: no validator was attached and the request reached the handler. An application that used false as a deny-all schema to make a route unreachable was therefore fully bypassed, and an unauthenticated remote client could reach the handler with any input. The same applied to the documented query alias for querystring. This is a complete bypass rather than a weak-schema issue, since false is the strongest JSON Schema assertion and must always fail.

Patches

Request-part schemas are now selected by an explicit presence check rather than truthiness, so a boolean false (or true) schema is compiled and enforced, including through the query alias. Patched in fastify 5.12.2. The fix is also included in the 6.0.0 release.

Workarounds

If upgrading is not immediately possible, express a deny-all request schema with an always-failing object schema instead of the boolean false (for example { "not": {} }), or reject the request in an onRequest hook.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6h
• https://nvd.nist.gov/vuln/detail/CVE-2026-84469
• https://github.com/fastify/fastify/commit/7de6e81697778f9f41bd327a3b1c5c9a0d9637b4
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.2
• https://github.com/advisories/GHSA-hwr6-493r-vm6h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

Fastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level properties keys and the root required array, and did not lowercase the JSON Schema Draft 7 dependencies keyword (its trigger keys and dependent property names) or names in nested subschemas. As a result, a header schema that uses dependencies to require one header when another is present (for example X-Admin requiring X-Admin-Token) never matches the lowercased request headers, so the dependency assertion is silently skipped. An unauthenticated remote client can send the header that activates a privileged path while omitting the header the dependency was meant to require, bypassing a schema-enforced security control. The header schema is idiomatic, valid JSON Schema Draft 7, and no custom validator, malformed request, or misconfiguration is required.

Patches

Header-schema names are now normalized across all schema positions (properties, required, dependencies, dependentRequired, dependentSchemas, and nested subschemas). Patched in fastify 5.12.2. The fix is also included in the 6.0.0 release. Header schemas referenced through an external shared $ref (registered with addSchema) are not reached by this normalization and now emit an FSTSEC002 startup warning; inline the header schema to keep case-insensitive assertions in effect.

Workarounds

If upgrading is not immediately possible, write header-schema names in lowercase so the dependencies and other case-sensitive assertions match Node's lowercased request headers, or enforce the cross-header requirement in an onRequest or preValidation hook instead of the schema.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58
• https://nvd.nist.gov/vuln/detail/CVE-2026-84428
• https://github.com/fastify/fastify/commit/179619c8e99d54924309b9933402151ef9af37e0
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.2
• https://github.com/advisories/GHSA-9q9j-q6p8-xq58

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

Fastify runs a route's validator and, for a result shaped like { value, error }, unwraps it: an error becomes a validation failure and value replaces the request part. This convention is intended for synchronous custom compilers (for example Joi). A JSON Schema $async validator, however, resolves with the validated data itself, so Fastify applied the same unwrapping to it. If a request part validated by an $async schema contains a value property, Fastify replaced the whole request part with that nested value before the handler ran, so a value or error property in the payload was attacker-controlled. An application that dispatches operations from the validated request body could then act on data that never satisfied the route schema, leading to unauthorized state changes or disclosure. Reaching the vulnerable path requires the route to use an $async request schema.

Patches

Fastify no longer treats an asynchronous validation result as a { value, error } wrapper: an async validator's resolved value is used only to determine pass or fail, and it can no longer replace the request part or inject an error. The synchronous custom-compiler contract is unchanged. Patched in fastify 5.12.2 and 6.0.0.

Workarounds

If upgrading is not immediately possible, avoid $async request schemas, or perform the security-sensitive check in an onRequest or preHandler hook rather than relying on the schema-validated request part. Custom async validator compilers should signal failure by throwing (rejecting) rather than returning an { error } object.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-667r-xxjv-c9mm
• https://nvd.nist.gov/vuln/detail/CVE-2026-84504
• https://github.com/fastify/fastify/commit/f02d8d4ab1ab208f10819c4dc213595b06497833
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.2
• https://github.com/advisories/GHSA-667r-xxjv-c9mm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

fastify crashes with an uncaught ERR_HTTP2_INVALID_CONNECTION_HEADERS exception when a route that registers a response trailer via reply.trailer() is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, terminating the Node.js process.

One unauthenticated HTTP/2 request to any route that uses trailers is enough to crash the server, dropping all in-flight requests, and the request can be repeated to keep the process down. Applications are affected only when HTTP/2 is enabled (http2: true) and at least one route registers a trailer. HTTP/1.x responses are not affected.

Patches

Upgrade to fastify 5.12.5 or later.

Workarounds

Avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/fastify/fastify/security/advisories/GHSA-4mh8-r7rc-xpvc
• https://nvd.nist.gov/vuln/detail/CVE-2026-92081
• https://github.com/fastify/fastify/issues/6574
• https://github.com/fastify/fastify/commit/ad06a4c3fe8a944a904f38068249b18b8f552e90
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.5
• https://github.com/advisories/GHSA-4mh8-r7rc-xpvc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

v5.12.5

Compare Source

⚠️ Security release

• Fix for GHSA-4mh8-r7rc-xpvc

What's Changed

• [Backport 5.x] perf: reduce content-type parser overhead by @​github-actions[bot] in #​7019
• [Backport 5.x] perf: avoid redundant request-part reads during validation by @​github-actions[bot] in #​7020

Full Changelog: fastify/fastify@v5.12.4...v5.12.5

v5.12.4

Compare Source

Fixed the fastify.js version mismatch.

Full Changelog: fastify/fastify@v5.12.2...v5.12.4

v5.12.3

Compare Source

v5.12.2

Compare Source

⚠️ Security release

• Fix for GHSA-9q9j-q6p8-xq58
• Fix for GHSA-hwr6-493r-vm6h
• Fix for GHSA-p68q-wchp-6fh7
• Fix for GHSA-667r-xxjv-c9mm

What's Changed

• [Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @​github-actions[bot] in #​6973
• [Backport 5.x] chore: npm ignore remaining agent files by @​github-actions[bot] in #​7003

Full Changelog: fastify/fastify@v5.12.1...v5.12.2

v5.12.1

Compare Source

⚠️ Security release

• Fix for GHSA-w2qp-rph6-63g4
• Fix for GHSA-3m5p-2c4r-xxw2

What's Changed

• [Backport 5.x] test: fix reply.mediaType by @​github-actions[bot] in #​6950
• [Backport 5.x] ci: allow backport in pr title by @​github-actions[bot] in #​6952
• [Backport 5.x] fix: run preClose hook exactly once per declaring instance by @​github-actions[bot] in #​6954
• [Backport 5.x] fix: report canonical route url for hidden prefix slash route by @​github-actions[bot] in #​6961

Full Changelog: fastify/fastify@v5.12.0...v5.12.1

v5.12.0

Compare Source

What's Changed

• chore(sponsor): add testmu ai by @​Eomm in #​6922
• docs: add per-route logging for Google Cloud Functions by @​slegarraga in #​6907
• test: remove @​sinonjs/fake-timers by @​climba03003 in #​6934
• [Backport 5.x] fix: remove raw response headers by @​github-actions[bot] in #​6939
• [Backport 5.x] test: use process-warning spyWarning for testing by @​github-actions[bot] in #​6945
• [Backport 5.x] feat: add Reply.prototype.mediaType by @​github-actions[bot] in #​6946
• [Backport 5.x] fix(content-type): return undefined for invalid media types by @​github-actions[bot] in #​6947

Full Changelog: fastify/fastify@v5.11.3...v5.12.0

v5.11.3

Compare Source

What's Changed

• fix: clear trailer state when removing all trailers by @​Ram-blip in #​6845
• docs: document percent-decoded route params as untrusted input by @​mcollina in #​6903
• docs(errors): document what the default error handler sends by @​basteez in #​6894
• docs(readme): fix grammar and cjs capitalization by @​minirang in #​6899
• fix: pass null instead of undefined to requestCompleted on success by @​lazerg in #​6837
• docs(encapsulation): clarify nested plugin scopes by @​jean-michelet in #​6893
• chore: Bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​6916
• chore: Bump fastify/workflows/.github/workflows/nested-quality.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​6917
• fix: recognize constructor-assigned built-in properties as decorator … by @​aquie00t in #​6892
• fix: reset lastIndex before testing global/sticky content-type RegExp parsers by @​zelinewang in #​6846

New Contributors

• @​minirang made their first contribution in #​6899
• @​lazerg made their first contribution in #​6837
• @​zelinewang made their first contribution in #​6846

Full Changelog: fastify/fastify@v5.11.2...v5.11.3

v5.11.2

Compare Source

What's Changed

• fix fastify version in fastify.js

Full Changelog: fastify/fastify@v5.11.1...v5.11.2

v5.11.1

Compare Source

What's Changed

• fix: add http method override warning by @​jean-michelet in #​6879
• fix(types): allow explicit http2: false in server options by @​Tony133 in #​6888
• docs: clarify what attachValidation exposes on request.validationError by @​basteez in #​6891
• fix: do not force close in-flight connections when forceCloseConnections is 'idle' by @​aquie00t in #​6889

New Contributors

• @​basteez made their first contribution in #​6891

Full Changelog: fastify/fastify@v5.11.0...v5.11.1

v5.11.0

Compare Source

What's Changed

• chore: Bump markdownlint-cli2 from 0.22.1 to 0.23.0 by @​dependabot[bot] in #​6839
• fix: normalize method in findRoute by @​Ram-blip in #​6838
• docs: fix incorrect description for validateInput in Request.md by @​thePranav-kpk in #​6823
• feat: rfc10008 http query method by @​climba03003 in #​6832
• perf: reuse cached content types for response serialization by @​gurgunday in #​6854
• chore(sponsor): add n-ix by @​Eomm in #​6852
• ci: pin actions to commit-hash by @​Fdawgs in #​6853
• ci(dependabot): temporarily ignore typescript updates by @​Tony133 in #​6869
• style(types): enforce max line length by @​jean-michelet in #​6864
• docs(ecosystem): update fastify-prisma repo URL by @​zrosenbauer in #​6724
• docs(getting-started): align import with exported routes by @​Solaris-star in #​6859
• docs(server): fix contradictory requestIdHeader default by @​sobol-sudo in #​6872
• fix(validation): correctly update falsy values from validator by @​jackjin1997 in #​6483
• docs: specific warning suppression by @​jean-michelet in #​6871
• ci(links-check): pin linkinator server root to the workspace by @​aquie00t in #​6877
• docs: update TypeScript docs to reference Fastify 5.x by @​Sasireddy001 in #​6880
• docs: use async trailer handlers in Reply examples by @​Ram-blip in #​6856
• docs: fix logController migration example and links by @​aquie00t in #​6876
• fix: uncatchable throws in writeHead when using async hook by @​climba03003 in #​6881
• fix: honor quoted-string in Content-Type parameter values by @​aquie00t in #​6865
• chore(.npmrc): add min-release-age by @​Fdawgs in #​6873
• chore: Bump actions/setup-node from 6.4.0 to 7.0.0 by @​dependabot[bot] in #​6866
• chore: Bump actions/labeler from 6.2.0 to 7.0.0 by @​dependabot[bot] in #​6867

New Contributors

• @​Ram-blip made their first contribution in #​6838
• @​Solaris-star made their first contribution in #​6859
• @​sobol-sudo made their first contribution in #​6872
• @​jackjin1997 made their first contribution in #​6483
• @​Sasireddy001 made their first contribution in #​6880

Full Changelog: fastify/fastify@v5.10.0...v5.11.0

v5.10.0

Compare Source

What's Changed

• docs(type-providers): clarify as const usage by @​smith558 in #​6772
• docs: fix broken and redirected links by @​Eomm in #​6817
• docs: remove marko from @​fastify/view engines (support dropped) by @​EduardF1 in #​6821
• fix: clear socket._meta on reply.hijack() when onTimeout is registered by @​nerkoux in #​6810
• docs: fix duplicate routeOptions entries in Request.md example by @​thePranav-kpk in #​6824
• chore: Bump @​types/node from 25.9.4 to 26.0.1 in the dev-dependencies-typescript group by @​dependabot[bot] in #​6829
• docs(ecosystem): add @​stitchapi/fastify to Community plugins by @​rejifald in #​6820
• feat: introduce log controller layer by @​Eomm in #​6580
• fix: use ContentType to detect json and charset in reply.send by @​climba03003 in #​6830
• docs: fix incorrect defaults and code examples in Server.md by @​Adit-Jain-srm in #​6805
• docs: fix incorrect hook count in Hooks.md by @​thePranav-kpk in #​6825
• chore: Bump fast-json-stringify from 6.4.0 to 7.0.0 in the dependencies group across 1 directory by @​dependabot[bot] in #​6800
• perf: reduce per-request overhead in the request lifecycle by @​mcollina in #​6831
• fix: derive request.port from request.host by @​mcollina in #​6680
• docs: update Logging.md with per-route log level info by @​asppsa in #​6627
• docs(type-providers): update import for article consistency by @​smith558 in #​6771

New Contributors

• @​EduardF1 made their first contribution in #​6821
• @​thePranav-kpk made their first contribution in #​6824
• @​rejifald made their first contribution in #​6820
• @​Adit-Jain-srm made their first contribution in #​6805
• @​asppsa made their first contribution in #​6627

Full Changelog: fastify/fastify@v5.9.0...v5.10.0

v5.9.0

Compare Source

What's Changed

• feat: add request.mediaType by @​climba03003 in #​6653
• docs: remove deprecated leveldb plugin and update ecosystem by @​Tony133 in #​6661
• chore(sponsor): add bestforandroid by @​Eomm in #​6659
• ci: drop Node.js 20 from yarn matrix in package-manager-ci.yml by @​Tony133 in #​6662
• fix: prevent duplicate res.end in sendTrailer with sync callbacks by @​climba03003 in #​6676
• fix: avoid duplicate closeIdleConnections call on native servers by @​trivikr in #​6669
• fix: error.code not present on some routing errors by @​mcollina in #​6678
• fix: correct isCustomSerializerCompiler flag check by @​eddieran in #​6657
• fix: validate invalid route logLevel at registration by @​maxpetrusenko in #​6523
• docs: update contribution rules by @​Tony133 in #​6670
• fix: use ContentType parser for response schema lookup by @​UlisesGascon in #​6685
• ci(ci): use shared quality workflow by @​Fdawgs in #​6688
• fix(types): allow request.getValidationFunction() to return undefined by @​trivikr in #​6665
• fix: do not trust forwarded host/proto when socket is missing by @​mcollina in #​6684
• perf: defer ContentType parsing in getSchemaSerializer until needed by @​aquie00t in #​6692
• perf: cache parsed ContentType objects in ContentTypeParser by @​aquie00t in #​6694
• perf: add typeof guard before toString.call in send and onSendEnd by @​aquie00t in #​6693
• chore: Bump pnpm/action-setup from 5.0.0 to 6.0.4 by @​dependabot[bot] in #​6704
• chore: Bump actions/github-script from 8 to 9 by @​dependabot[bot] in #​6705
• chore: Bump JustinBeckwith/linkinator-action from 2.4.0 to 2.4.2 by @​dependabot[bot] in #​6706
• docs: correct return503OnClosing comment in route.js by @​mcollina in #​6712
• fix: enable diagnostics tracking for async error handlers by @​irzix in #​6458
• fix: ignore duplicate trailer completions by @​mcollina in #​6714
• feat: add support of onMaxParamLength by @​climba03003 in #​6716
• chore: introduce TSTyche for type testing by @​mrazauskas in #​6532
• docs(reference): grammar and readability fixes by @​Fdawgs in #​6710
• chore: update depedabot setting by @​climba03003 in #​6715
• fix: include hint and docs URL in FSTWRN004 warning message by @​aquie00t in #​6723
• ci(ci): do not pass secrets to reusable workflow by @​Fdawgs in #​6744
• docs: add fastify-intlayer to ecosystem documentation by @​aymericzip in #​6594
• chore: Bump concurrently from 9.2.1 to 10.0.0 by @​dependabot[bot] in #​6752
• docs(Errors): fix incorrect usage of root fastify inside plugin scope by @​Rpaudel379 in #​6731
• ci: add node 26 to test matrices by @​Fdawgs in #​6728
• docs(Warnings): remove retired FSTWRN002 warning code by @​leestana01 in #​6754
• fix: chunk large HTTP/2 buffer replies by @​mcollina in #​6746
• chore: migrate type tests to TSTyche assertions (part one) by @​mrazauskas in #​6726
• chore: migrate type tests to TSTyche assertions (part two) by @​mrazauskas in #​6727
• docs: fix doubled braces in serializerCompiler signature by @​DucMinhNe in #​6747
• docs: remove HackerOne reporting link by @​jhcpeixoto in #​6735
• refactor(decorate): replace find with some in hasKey for correct boolean semantics by @​aquie00t in #​6759
• fix: replace AssertionError with FST_ERR_PLUGIN_DEPENDENCY_NOT_REGISTERED in checkDependencies by @​aquie00t in #​6774
• docs(ecosystem): add @​inferdi/fastify by @​maxrendel in #​6742
• docs(typo): Write-Plugin.md by @​zakirimadullahprogrammer-tech in #​6776
• docs: fix duplicate anchor IDs causing broken TOC links by @​AliMahmoudDev in #​6770
• docs: add fastify-ata as a JSON Schema validator option by @​mertcanaltin in #​6733
• chore: rename type test files by @​mrazauskas in #​6762
• docs: update ajv-errors guidance by @​Herrtian in #​6741
• chore(warnings): correct duplicate 'not' typos in inline comments by @​mixelburg in #​6713
• docs: add fastify-param-schema-validation to ecosystem by @​Player1205 in #​6760
• docs(ecosystem): add @​thecodepace/fastify-http-query by @​Puppo in #​6785
• chore: Bump esbuild from 0.25.12 to 0.28.1 in /test/bundler/esbuild in the npm_and_yarn group across 1 directory by @​dependabot[bot] in #​6788
• fix: clear socket._meta after response to prevent keep-alive leaks by @​nerkoux in #​6799
• fix: avoid double slash when joining nested prefixes by @​rohithvegesna in #​6803
• docs(sponsors): Update sponsors list by removing two entries by @​Eomm in #​6792
• chore: Bump fastify-plugin from 5.1.0 to 6.0.0 by @​dependabot[bot] in #​6801
• chore(package.json): fix delvedor's personal url by @​Fdawgs in #​6808
• chore: replace http with https in urls by @​Fdawgs in #​6809
• chore: add new sponsor by @​Eomm in #​6813
• chore: Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​6812
• fix: hasRequestDecorator/hasReplyDecorator misses constructor-assigned built-in properties by @​LeSingh1 in #​6753
• docs: migrate Zod type provider to official @​fastify package by @​Tony133 in #​6686
• docs: add warning about empty string coercion with nullable types by @​ritambh888 in #​6452
• docs: fix incorrect code examples in Hooks and Server reference by @​rrodj in #​6622
• docs: update Serverless guide Dockerfile to a supported Node.js version by @​harish885 in #​6789
• docs(types): mark request metadata accessors as untrusted input by @​mcollina in #​6572
• Bumped v5.9.0 by @​Eomm in #​6816

New Contributors

• @​eddieran made their first contribution in #​6657
• @​irzix made their first contribution in #​6458
• @​aymericzip made their first contribution in #​6594
• @​Rpaudel379 made their first contribution in #​6731
• @​leestana01 made their first contribution in #​6754
• @​DucMinhNe made their first contribution in #​6747
• [@​jhcpeixoto](ht

[!IMPORTANT]
✂ PR body was truncated to here.