Skip to content

Update dependency fastify to v5 [SECURITY]#997

Open
renovate[bot] wants to merge 3 commits intomasterfrom
renovate/npm-fastify-vulnerability
Open

Update dependency fastify to v5 [SECURITY]#997
renovate[bot] wants to merge 3 commits intomasterfrom
renovate/npm-fastify-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Feb 3, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
fastify (source) 4.29.1 → 5.7.3 age confidence

GitHub Vulnerability Alerts

CVE-2026-25224

Impact

A Denial of Service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation.

Patches

The issue is fixed in Fastify 5.7.3. Users should upgrade to 5.7.3 or later.

Workarounds

Avoid sending Web Streams from Fastify responses (e.g., ReadableStream or Response bodies). Use Node.js streams (stream.Readable) or buffered payloads instead until the project can upgrade.

References

CVE-2026-25223

Impact

A validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type.

For example, a request with Content-Type: application/json\ta will bypass JSON schema validation but still be parsed as JSON.

This vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints. The concrete impact depends on the handler implementation and the level of trust placed in the validated request body, but at the library level, this allows complete bypass of body validation for any handler using Content-Type-discriminated schemas.

This issue is a regression or missed edge case from the fix for a previously reported vulnerability.

Patches

This vulnerability has been patched in Fastify v5.7.2. All users should upgrade to this version or later immediately.

Workarounds

If upgrading is not immediately possible, user can implement a custom onRequest hook to reject requests containing tab characters in the Content-Type header:

fastify.addHook('onRequest', async (request, reply) => {
  const contentType = request.headers['content-type']
  if (contentType && contentType.includes('\t')) {
    reply.code(400).send({ error: 'Invalid Content-Type header' })
  }
})

Resources

Release Notes

fastify/fastify (fastify)

v5.7.3

Compare Source

⚠️ Security Release
What's Changed

Full Changelog: fastify/fastify@v5.7.2...v5.7.3

v5.7.2

Compare Source

⚠️ Notice ⚠️

Parsing of the content-type header has been improved to a strict parser in PR #​6414. This means only header values in the form described in RFC 9110 are accepted.

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.7.1...v5.7.2

v5.7.1

Compare Source

What's Changed

Full Changelog: fastify/fastify@v5.7.0...v5.7.1

v5.7.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.6.2...v5.7.0

v5.6.2

Compare Source

v5.6.1

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.6.0...v5.6.1

v5.6.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.5.0...v5.6.0

v5.5.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.4.0...v5.5.0

v5.4.0

Compare Source

What's Changed

Full Changelog: fastify/fastify@v5.3.3...v5.4.0

v5.3.3

Compare Source

What's Changed
New Contributors

Full Changelog: fastify/fastify@v5.3.2...v5.3.3

v5.3.2

Compare Source

⚠️ Security Release ⚠️

Unfortunately, v5.3.1 did not include a complete fix for "Invalid content-type parsing could lead to validation bypass" and CVE-2025-32442. This is a follow-up patch to cover an edge case.

What's Changed
New Contributors

Full Changelog: fastify/fastify@v5.3.1...v5.3.2

v5.3.1

Compare Source

⚠️ Security Release ⚠️
What's Changed
New Contributors

Full Changelog: fastify/fastify@v5.3.0...v5.3.1

v5.3.0

Compare Source

What's Changed
New Contributors

Full Changelog: fastify/fastify@v5.2.2...v5.3.0

v5.2.2

Compare Source

What's Changed
  • build: use static path instead of

Configuration

📅 Schedule: Branch creation - "" in timezone America/Los_Angeles, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the renovate label Feb 3, 2026
ecraig12345
ecraig12345 requested changes Feb 3, 2026
View reviewed changes
Copy link
Member

@ecraig12345 ecraig12345 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not currently possible since fastify v5 requires Node 20 despite apparently not specifying engines...

@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from a0025dc to 7ca4536 Compare February 17, 2026 17:30
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 7ca4536 to 00bf2bc Compare February 24, 2026 07:41
dannyvv
dannyvv requested changes Feb 27, 2026
View reviewed changes
Copy link
Member

@dannyvv dannyvv left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See ecraig

@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from 5fcc2a6 to 2601d44 Compare March 5, 2026 19:50
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 2601d44 to e04dac2 Compare March 13, 2026 11:43
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from e04dac2 to b6c6e3e Compare March 13, 2026 19:39
@renovate
Copy link
Contributor Author

renovate bot commented Mar 13, 2026

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock
! Corepack is about to download https://repo.yarnpkg.com/4.12.0/packages/yarnpkg-cli/bin/yarn.js

@renovate
Copy link
Contributor Author

renovate bot commented Mar 13, 2026

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@ecraig12345
Copy link
Member

ecraig12345 commented Mar 13, 2026 •
edited
Loading

The fastify update also requires updating connectrpc to v2. So I pushed those changes plus a temporary version of the Node upgrade, but this still can't be checked in until the real Node upgrade major bump is done. Also still waiting on manual testing of lage-server in a real repo.

If needed:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ecraig12345 ecraig12345 ecraig12345 requested changes

@dannyvv dannyvv dannyvv requested changes

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ecraig12345 @dannyvv