Skip to content

Upgrading fastify 4 to 5

Breaking4.29.1 → 5.12.8Breaking21Security15New27Changed34Fixed104Other606

Full comparisonBack to fastify
Fetching 44 releases from GitHub…43 / 44
BreakingUpgrade verdict

21 breaking changes and 15 security fixes.

In plain terms
  • Removes connection property in FastifyRequest types.
  • Two methods for setting and reading the default route are gone.
  • Fastify no longer reads a request id header by default.
  • Calling listen with positional arguments instead of an options object no longer works.
Must act Top 5 of 36 that need code or config changes

What you must change

Breaking21
Removes connection property in FastifyRequest types.
FastifyRequestFastifyRequest.connection
5.2.0GitHub ReleaseSummarizedView source
Removes the setDefaultRoute and getDefaultRoute methods.
setDefaultRoutegetDefaultRoute
5.0.0GitHub ReleaseSummarizedView source
Changes the request id header default value to false.
requestIdHeader
5.0.0GitHub ReleaseSummarizedView source
Removes the deprecated variadic listen signature.
listen
5.0.0GitHub ReleaseSummarizedView source
Removes the variadic listen types.
listen
5.0.0GitHub ReleaseSummarizedView source
Request and reply decorators can no longer be a reference type.
5.0.0GitHub ReleaseSummarizedView source
Removes reply.getResponseTime().
reply.getResponseTime()
5.0.0GitHub ReleaseSummarizedView source
Removes the json shorthand option.
json
5.0.0GitHub ReleaseSummarizedView source
Removes deprecation code 005.
5.0.0GitHub ReleaseSummarizedView source
Removes deprecation code FSTDEP007.
FSTDEP007
5.0.0GitHub ReleaseSummarizedView source
Removes deprecation codes FSTDEP008 and FSTDEP009.
FSTDEP008FSTDEP009
5.0.0GitHub ReleaseSummarizedView source
Removes deprecation code FSTDEP010.
FSTDEP010
5.0.0GitHub ReleaseSummarizedView source
Removes deprecation code FSTDEP021.
FSTDEP021
5.0.0GitHub ReleaseSummarizedView source
Removes deprecation codes FSTDEP012, FSTDEP015, FSTDEP016, FSTDEP017, FSTDEP018 and FSTDEP019.
FSTDEP012FSTDEP015FSTDEP016FSTDEP017FSTDEP018FSTDEP019
5.0.0GitHub ReleaseSummarizedView source
Removes deprecation code FSTDEP013.
FSTDEP013
5.0.0GitHub ReleaseSummarizedView source
Removes the nonexistent done parameter from the onRegister type.
onRegister
5.0.0GitHub ReleaseSummarizedView source
Parses the content-type header with a strict parser, accepting only RFC 9110 forms.
content-type
5.7.2GitHub ReleaseSummarizedView source
Moves router options to their own key.
5.5.0GitHub ReleaseSummarizedView source
Disallows decorate('name', null) in the TypeScript types.
decorate
5.0.0GitHub ReleaseSummarizedView source
Changes the reply.redirect() signature.
reply.redirect()
5.0.0GitHub ReleaseSummarizedView source
Re-orders FastifyReply generic parameters in the TypeScript types.
FastifyReply
5.0.0GitHub ReleaseSummarizedView source
Security15
Fixes the vulnerability described in security advisory GHSA-389g-gv7q-r4x8.
Low · CVSS 3.7
5.12.6GitHub ReleaseSummarizedView source
Fixes a security vulnerability described in advisory GHSA-4mh8-r7rc-xpvc.
Moderate · CVSS 5.9
5.12.5GitHub ReleaseSummarizedView source
Fixes security advisory GHSA-9q9j-q6p8-xq58.
High · CVSS 7.5
5.12.2GitHub ReleaseSummarizedView source
Fixes security advisory GHSA-hwr6-493r-vm6h.
High · CVSS 7.5
5.12.2GitHub ReleaseSummarizedView source
Fixes security advisory GHSA-p68q-wchp-6fh7.
High · CVSS 7.5
5.12.2GitHub ReleaseSummarizedView source
Fixes security advisory GHSA-667r-xxjv-c9mm.
High · CVSS 8.1
5.12.2GitHub ReleaseSummarizedView source
Fixes security advisory GHSA-w2qp-rph6-63g4.
Moderate · CVSS 5.4
5.12.1GitHub ReleaseSummarizedView source
Fixes security advisory GHSA-3m5p-2c4r-xxw2.
Moderate · CVSS 6.1
5.12.1GitHub ReleaseSummarizedView source
Stops trusting forwarded host and proto headers when the socket is missing.
5.9.0GitHub ReleaseSummarizedView source
Fixes CVE-2026-33806, a security vulnerability in fastify.
High · CVSS 7.5
5.8.5GitHub ReleaseSummarizedView source
Fixes CVE-2026-3635, a security vulnerability in fastify.
Moderate · CVSS 6.1
5.8.3GitHub ReleaseSummarizedView source
Fixes missing end anchor in subtypeNameReg that allowed malformed Content-Types to pass validation (CVE-2026-3419).
subtypeNameRegModerate · CVSS 5.3
5.8.1GitHub ReleaseSummarizedView source
Fixes security advisory GHSA-mrq3-vjjr-p77c, tracked as CVE-2026-25224.
Low · CVSS 3.7
5.7.3GitHub ReleaseSummarizedView source
Fastify's Content-Type header tab character allows body validation bypass
High · CVSS 7.5
5.7.2GitHub AdvisoryOriginalView source
Fixes invalid content-type parsing that could lead to validation bypass (CVE-2025-32442).
5.3.1GitHub ReleaseSummarizedView source