Fastify 5

Apply these conventions when working with Fastify code in node.js projects.

Server Setup

• Fastify 5 targets Node.js 20+. Do not write guidance that assumes Node 18 compatibility for new Fastify 5 apps.
• Current Fastify 5 stable is 5.12.1; keep production apps on at least 5.12.1 for the August 2026 security fixes.
• Create the Fastify instance with explicit options: logger: true (or Pino config object), loggerInstance for an existing Pino-compatible logger, trustProxy when behind a reverse proxy.
• Set requestTimeout when exposed without a reverse proxy; use handlerTimeout for application-level route lifecycle timeouts and pass request.signal into cancellable work.
• For custom request-log behavior or request-id log labels, prefer logController: new LogController(...); top-level disableRequestLogging and requestIdLogLabel are deprecated for removal in Fastify 6.
• Do not rely on semicolon query delimiters; Fastify 5 defaults routerOptions.useSemicolonDelimiter to false. Enable it only for legacy clients that send /path;foo=bar.
• Treat forwarded request.ip / request.host / request.protocol as untrusted unless trustProxy is restricted to the real proxy chain; avoid hop-count-only custom trust functions.
• Separate app construction (app.ts) from server startup (server.ts / cluster.ts) to enable testing via inject() without starting the server.