Fastify 5 lifecycle
Current status
Fastify 5 is currently in standard support.
Security: 4 tracked advisories affecting this line. Details below — lifecycle and vulnerability status are separate.
Official lifecycle source: Fastify npm releases
- Support phase
- standard support
- End of life
- Not officially published
- Latest release
- 5.3.3
- Released
- 13 May 2025
At a glance
- Version line
- 5
- Initial release
- 17 Sept 2024
- Lifecycle phase
- standard support
- Latest stable
- 5.3.3
- Latest release date
- 13 May 2025
- EOL
- Not officially published
- Risk
- low
- Releases tracked
- 33
Lifecycle timeline
Phases from published LifecyclePeriod records. Missing phases are not inferred.
Release
17 Sept 2024
standard supportcurrent
17 Sept 2024 → —
Source: Fastify npm releases
Fastify 5 is currently in standard support.
Security
Advisories affecting Fastify 5 (OSV.dev evidence). Known exploited status, due dates, and ransomware use from CISA KEV when matched.
- Known vulnerabilities
- 4
- Known exploited
- 0
- Highest CVSS
- —
- CVE-2026-18504GHSA-w2qp-rph6-63g4
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
- Affected:
- <5.12.1
- Fixed in:
- 5.12.1
- Source:
- OSV source · Advisory
- CVE-2026-3635GHSA-444r-cwp2-x5xf
fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections
- Affected:
- <5.8.3
- Fixed in:
- 5.8.3
- Source:
- OSV source · Advisory
- CVE-2026-25224GHSA-mrq3-vjjr-p77c
Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream
- Affected:
- <5.7.3
- Fixed in:
- 5.7.3
- Source:
- OSV source · Advisory
- CVE-2026-25223GHSA-jx2c-rxcm-jvmq
Fastify's Content-Type header tab character allows body validation bypass
- Affected:
- <5.7.2
- Fixed in:
- 5.7.2
- Source:
- OSV source · Advisory
Latest release
Previous releases
5.4.0
12 Jun 2025
5.5.0
11 Aug 2025
5.3.2
18 Apr 2025
Release history
33 concrete releases tracked for this line.
| Version | Release date | Channel | Source |
|---|---|---|---|
| 5.3.2 | 18 Apr 2025 | stable | Source |
| 5.3.3 | 13 May 2025 | stable | Source |
| 5.4.0 | 12 Jun 2025 | stable | Source |
| 5.5.0 | 11 Aug 2025 | stable | Source |
| 5.6.0 | 5 Sept 2025 | stable | Source |
| 5.6.1 | 22 Sept 2025 | stable | Source |
| 5.6.2 | 9 Nov 2025 | stable | Source |
| 5.7.0 | 15 Jan 2026 | stable | Source |
| 5.7.1 | 16 Jan 2026 | stable | Source |
| 5.7.2 | 26 Jan 2026 | stable | Source |
| 5.7.3 | 2 Feb 2026 | stable | Source |
| 5.7.4 | 2 Feb 2026 | stable | Source |
| 5.8.0 | 5 Mar 2026 | stable | Source |
| 5.8.1 | 5 Mar 2026 | stable | Source |
| 5.8.2 | 7 Mar 2026 | stable | Source |
| 5.8.3 | 23 Mar 2026 | stable | Source |
| 5.8.4 | 23 Mar 2026 | stable | Source |
| 5.8.5 | 14 Apr 2026 | stable | Source |
| 5.9.0 | 28 Jun 2026 | stable | Source |
| 5.10.0 | 5 Jul 2026 | stable | Source |
| 5.11.0 | 30 Jul 2026 | stable | Source |
| 5.11.1 | 3 Aug 2026 | stable | Source |
| 5.11.2 | 3 Aug 2026 | stable | Source |
| 5.0.0 | 17 Sept 2024 | stable | Source |
| 5.1.0 | 31 Oct 2024 | stable | Source |
Release activity
- Total releases
- 33
- Last 30 days
- 3
- Last 90 days
- 8
- Avg. interval
- ~22 days
- Most recent
- 13 May 2025
Should I use this version?
Suitable for new deployments
Fastify 5 is currently supported (standard support).
Version comparison
Compact comparison against the nearest relevant release lines.
Sources
Where this information comes from.
Lifecycle sources
- Fastify npm releasesfirst party · high confidence
Official source: https://www.npmjs.com/package/fastify
Last verified 2 Sept 2026
- OSV.devfirst party
Official source: https://osv.dev
Verification time not recorded
- NVD (NIST)first party
Official source: https://nvd.nist.gov
Verification time not recorded
- CISA Known Exploited Vulnerabilitiesfirst party
Official source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Verification time not recorded
Release sources
- Fastify npm releasesfirst party · high confidence
Official source: https://www.npmjs.com/package/fastify
Last verified 2 Sept 2026
Data coverage
Last checked = last successful upstream check. Latest source update = when upstream content last changed.
- Releases tracked
- 33
- Lifecycle periods
- 1
- EOL
- Not officially published
- Provenance records
- 2
- Data last checked
- 2 Sept 2026
- Latest source update
- 2 Sept 2026
EOL: Not officially published
