Backend framework
Fastify: latest release and open vulnerabilities today
The latest release of the fastify package is 5.12.7. 5 high or critical advisories for the fastify package were published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities.
Last checked against npm, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest fastify release
- 5.12.7
- npm downloads last week
- 15.4M
- GitHub stars
- 37.3k
- Licence
- MIT
- OpenSSF Scorecard
- 8.3 / 10
Security advisories
11 advisories published in the last 12 months, 5 of them high or critical. 16 in total since records began. Checked packages: fastify.
fastify vulnerable to request body replacement via an async validation result collision
Fixed in 5.12.2.
EPSS: top 65%fastify vulnerable to header validation bypass via incomplete schema case normalization
Fixed in 5.12.2.
EPSS: top 57%fastify vulnerable to request validation bypass via skipped boolean false schemas
Fixed in 5.12.2.
EPSS: top 60%fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
Fixed in 5.12.2.
EPSS: top 57%Fastify's Content-Type header tab character allows body validation bypass
Fixed in 5.7.2.
EPSS: top 42%
Maintenance and supply chain
OpenSSF Scorecard 8.3 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 15 issue updates found in the last 90 days.
Weakest checks
- No static analysis (SAST 3/10)
Alternatives
Express.js
Minimal Node.js web framework
Strengths
- Lightweight and flexible
- Huge ecosystem
Trade-offs
- Minimal built-in features
- Manual setup required
Django
High-level Python web framework with batteries included
Strengths
- Comprehensive built-in features (ORM, admin, auth)
- Secure by default (CSRF, SQL injection protection)
Trade-offs
- Monolithic and opinionated
- Slower than lightweight frameworks
FastAPI
Modern Python framework for building APIs with type hints
Strengths
- Extremely fast performance (on par with Node/Go)
- Automatic API documentation (OpenAPI/Swagger)
Trade-offs
- Younger ecosystem than Django/Flask
- Less built-in features than Django
Ruby on Rails
Full-stack web framework emphasizing convention over configuration
Strengths
- Convention over configuration (rapid development)
- Rich ecosystem of gems (libraries)
Trade-offs
- Slower runtime performance than competitors
- Monolithic architecture can be restrictive
Docs and release notes
Check Fastify in your own stack
This page checks Fastify in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.