Back to Explore

fastify/fastify-cors

GitHub
3 updates · last 90 daysOpen source

Last release:

@fastify/cors is a Fastify plugin that adds CORS (Cross-Origin Resource Sharing) headers to responses, and it can also register an OPTIONS preflight route. It is useful for configuring which request origins, methods, headers, and credentials are allowed in a Fastify application, with options like `origin`, `methods`, `allowedHeaders`, and `credentials`.

Project status

  • Actively maintained, with an upstream push and update on 2026-11-02, just days before today.
  • Updates have been uneven: after a gap of about four months between December 2025 and July 2026, there were three updates from July through November 2026.

AI summary generated

AI-generated from public sources. May be inaccurate. Report

Recent updates

  • v11.4.1

    v11.4.1 fixes Vary-header parsing when a token is followed by whitespace before a comma, preventing valid tokens such as `*` from being lost. The implementation also adds coverage for whitespace handling around comma-separated tokens; no public API or function signatures changed.

  • v11.4.0

    v11.4.0 is a security release that fixes the fastify-cors advisory GHSA-8c3j-mm64-257c. It also clarifies that RegExp origin patterns are tested as written, and updates the reusable release workflow reference. The code additionally removes support for the `onSend` hook, a breaking change not called out in the release notes.

    BreakingSecurity

  • v11.3.1

    v11.3.1 is primarily a tooling and release pipeline update for @fastify/cors. It pins CI workflow references to commit hashes, adds a release workflow that enables OIDC-based trusted publishing, and bumps the c8 coverage tool.

  • v11.3.0

    v11.3.0 is primarily a tooling and CI maintenance release, with dependency bumps and a migration of the TypeScript type tests from tsd to tstyche. The provided code diff also shows only documentation and test assertion adjustments, without any changes to the core CORS runtime logic.

    Breaking

  • v11.2.0

    v11.2.0 adds support for route-level CORS configuration via `config.cors`, allowing per-route overrides of the plugin registration options. The release also includes dev and CI housekeeping (TypeScript/tsd bumps, workflow concurrency, and minor README updates).

    Features

  • v11.1.0

    v11.1.0 primarily adds a new `logLevel` option to suppress logging for the internal CORS preflight `OPTIONS *` route. The release also updates TypeScript typings for this option and bumps some dev dependencies. Code changes indicate an additional behavioral fix around `hideOptionsRoute` handling when using `delegator`, which is not mentioned in the release notes.

    Features

  • v11.0.1

    v11.0.1 mainly performs dependency and tooling maintenance, including TypeScript and a cache library replacement. The only user-facing note in this release is a README correction for the `methods` default documentation.

  • v11.0.0

    This release (v11.0.0) changes the default CORS `methods` behavior to only allow CORS-safelisted methods, which directly affects the `Access-Control-Allow-Methods` header returned on preflight requests. It also includes minor code style refactors in tests (destructured imports).

    Breaking

  • v10.1.0

    Release v10.1.0 primarily adds the ability to disable CORS per route, plus some maintenance updates (dependency bump, CI branch rename, and documentation/test cleanups). The code diff shows a new early-return in the CORS request handler based on route-level configuration, and a small internal refactor in Vary header parsing.

    Features

  • v10.0.2

    v10.0.2 is primarily a dependency and tooling refresh (TypeScript, neostandard, CI workflow updates) plus small README maintenance. The runtime code change is limited to an optional chaining refactor and renaming unused hook parameters to underscore-prefixed variables.

  • v10.0.1

    v10.0.1 is a small release that updates the package version and bumps the Fastify dependency. The only code changes in this diff are in package.json, changing Fastify from the alpha prerelease to the stable v5 range.

  • v10.0.0

    v10.0.0 primarily updates dependencies and modernizes the project test setup by migrating from tap to node:test with c8. It also adds Promise-based origin support types and updates documentation to warn about potential DoS risks when using RegExp or function-based origin matching.

    SecurityFeatures

  • v9.0.1

    v9.0.1 updates @fastify/cors behavior for CORS headers generated from delegated (dynamic resolver) options. The change ensures the response includes the proper Vary: Origin header when using delegated origin configuration.

    Features