CompatHub
Check EOL

Fastify 4 lifecycle

Current status

standard supportlow

Fastify 4 is currently in standard support.

Security: 4 tracked advisories affecting this line. Details below — lifecycle and vulnerability status are separate.

Official lifecycle source: Fastify npm releases

Support phase
standard support
End of life
Not officially published
Latest release
4.0.1
Released
10 Jun 2022

At a glance

Version line
4
Initial release
8 Jun 2022
Lifecycle phase
standard support
Latest stable
4.0.1
Latest release date
10 Jun 2022
EOL
Not officially published
Risk
low
Releases tracked
61

Lifecycle timeline

Phases from published LifecyclePeriod records. Missing phases are not inferred.

  1. Release

    8 Jun 2022

  2. standard supportcurrent

    8 Jun 2022 → —

    Source: Fastify npm releases

Fastify 4 is currently in standard support.

Upgrade options

Newer supported Fastify version lines from CompatHub lifecycle data. Compatibility and security context use existing evidence only.

You are on Fastify 4

Supported

Supported upgrade options

Open full upgrade planner for Fastify 4 →

Security

Advisories affecting Fastify 4 (OSV.dev evidence). Known exploited status, due dates, and ransomware use from CISA KEV when matched.

Known vulnerabilities
4
Known exploited
0
Highest CVSS
—
  • CVE-2026-18504GHSA-w2qp-rph6-63g4

    fastify vulnerable to schema validation bypass via root primitive coercion mismatch

    Affected:
    <5.12.1
    Fixed in:
    5.12.1
    Source:
    OSV source · Advisory
  • CVE-2026-3635GHSA-444r-cwp2-x5xf

    fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections

    Affected:
    <5.8.3
    Fixed in:
    5.8.3
    Source:
    OSV source · Advisory
  • CVE-2026-25224GHSA-mrq3-vjjr-p77c

    Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream

    Affected:
    <5.7.3
    Fixed in:
    5.7.3
    Source:
    OSV source · Advisory
  • CVE-2026-25223GHSA-jx2c-rxcm-jvmq

    Fastify's Content-Type header tab character allows body validation bypass

    Affected:
    <5.7.2
    Fixed in:
    5.7.2
    Source:
    OSV source · Advisory

Latest release

4.0.1

Released 10 Jun 2022 · stable

https://registry.npmjs.org/fastify/4.0.1

Previous releases

  • 4.0.2

    13 Jun 2022

  • 4.0.3

    15 Jun 2022

  • 4.0.0

    8 Jun 2022

Release history

61 concrete releases tracked for this line.

VersionRelease dateChannelSource
4.0.110 Jun 2022stableSource
4.0.213 Jun 2022stableSource
4.0.315 Jun 2022stableSource
4.1.021 Jun 2022stableSource
4.2.028 Jun 2022stableSource
4.2.112 Jul 2022stableSource
4.3.021 Jul 2022stableSource
4.4.08 Aug 2022stableSource
4.5.017 Aug 2022stableSource
4.5.118 Aug 2022stableSource
4.5.218 Aug 2022stableSource
4.5.326 Aug 2022stableSource
4.6.014 Sept 2022stableSource
4.7.030 Sept 2022stableSource
4.8.010 Oct 2022stableSource
4.8.110 Oct 2022stableSource
4.9.017 Oct 2022stableSource
4.9.117 Oct 2022stableSource
4.9.218 Oct 2022stableSource
4.10.016 Nov 2022stableSource
4.10.121 Nov 2022stableSource
4.10.221 Nov 2022stableSource
4.11.01 Jan 2023stableSource
4.12.021 Jan 2023stableSource
4.0.08 Jun 2022stableSource

Release activity

Total releases
61
Last 30 days
0
Last 90 days
0
Avg. interval
~23 days
Most recent
10 Jun 2022

Should I use this version?

Suitable for new deployments

Fastify 4 is currently supported (standard support).

Version comparison

Compact comparison against the nearest relevant release lines.

45
Statusstandard supportstandard support
Latest release4.26.15.12.1
EOLNot publishedNot published
Risklowlow

Sources

Where this information comes from.

Lifecycle sources

Release sources

Data coverage

Last checked = last successful upstream check. Latest source update = when upstream content last changed.

Releases tracked
61
Lifecycle periods
1
EOL
Not officially published
Provenance records
2
Data last checked
2 Sept 2026
Latest source update
2 Sept 2026

EOL: Not officially published

Other Fastify versions