@fastify/static is a Fastify plugin for serving static files, designed to be as fast as possible. It lets you mount a filesystem directory under a URL prefix and control options like cache headers, wildcard routing, and directory redirects.
Project status
- Active maintenance is evident, with an upstream GitHub push on 2026-08-26 and recent plugin updates into late August 2026.
- Apparent update cadence is frequent during August-July 2026 (updates on 2026-08-19, 2026-07-22, 2026-07-11, 2026-07-08), suggesting an active development stream rather than long dormancy.
AI summary generated
Recent updates
v10.1.3
v10.1.3 primarily contains chore-level dependency and workflow updates per the release notes. However, the actual code diff adds new non-canonical path detection and introduces stricter request rejection logic in fastify-static, which changes observable HTTP behavior for certain “odd” URL path forms.
BreakingSecurityv10.1.2
v10.1.2 is a security-focused release with CI workflow action pinning to a commit hash. The code diff also introduces a functional change affecting how the `allowedPath` option is evaluated against the request pathname.
Securityv10.1.1
v10.1.1 is a security release that addresses GHSA-83w8-p2f5-377r. The only other documented change is a README typo fix, but the code diff shows additional security hardening around dot-dot (.. ) path segments and how such requests are rejected.
Securityv10.1.0
v10.1.0 adds proper cache variation handling for pre-compressed static responses by setting Vary: Accept-Encoding when `preCompressed` is enabled. It also introduces `suppressWarning` and switches option validation errors to structured errors created with `@fastify/error` (custom error codes and types).
Featuresv10.0.0
v10.0.0 of @fastify/static introduces a breaking API change for the `setHeaders` option, switching it from a raw response object to a Fastify `reply` so it can use reply helper methods. It also updates handling around precompressed encodings (notably deflate) and bumps `content-disposition`.
Breakingv9.3.0
Release v9.3.0 is a small change focused on updating the @fastify/static dependency on fastify-plugin. The only code diff is a dependency version bump in package.json, from fastify-plugin v5 to v6.
v9.2.0
v9.2.0 updates @fastify/static with a runtime fix to propagate the return value from Fastify's error handler, plus several documentation and developer tooling changes. It also bumps @fastify/compress and @types/node, and migrates the TypeScript type-test setup from tsd to tstyche.
v9.1.3
v9.1.3 fixes wildcard prefix handling when the Fastify route prefix contains route parameters (for example, prefixes like /app/:version with wildcard paths). The implementation changes how the plugin derives the “remainder” path from the raw request URL for wildcard routes, replacing simple string prefix matching with a route-prefix matcher that understands Fastify-style :params.
v9.1.2
v9.1.2 contains a targeted fix intended to resolve wildcard path handling when fastify-static is registered inside encapsulated contexts (such as nested plugins with a mount prefix). The release notes describe only this behavior change.
v9.1.1
v9.1.1 is a security-focused release for @fastify/static, fixing CVE-2026-6410 and CVE-2026-6414. Besides a CI workflow addition, the code diff shows significant changes to how request URLs and directory listing paths are normalized and validated to prevent path traversal and related edge cases.
BreakingSecurityFeaturesv9.1.0
v9.1.0 updates various dev dependencies and CI tooling, and includes a bug fix for sendFile behavior related to how options are applied. The code diff also shows broader internal plumbing changes to pass option data through file-serving fallbacks, plus additional tests for multiple roots. Some TypeScript declaration header/reference changes are not called out in the release notes.