@fastify/send is a Node.js library for streaming files from the file system as HTTP responses. It supports range requests (partial responses), conditional GET negotiation, and configurable response headers such as Content-Type, Last-Modified, ETag, and Cache-Control. This fastify-specific fork is provided via npm under @fastify/send and was created to address CVE-2017-20165.
Project status
- The source is actively maintained: its latest update and upstream push were on November 2, 2026.
- Cadence is uneven. After a gap of over a year between June 2025 and August 2026, updates picked up, with several in October and November 2026.
AI summary generated
Recent updates
v4.2.1
v4.2.1 fixes conditional GET handling so a request with If-Modified-Since does not receive a 304 response when the response has no Last-Modified header. The release also updates the pinned reusable release workflow.
v4.2.0
v4.2.0 adds a new `onFile` hook option that is invoked after file resolution and before response stream creation. The hook can be async, and `send()` will wait for it, aborting if it throws or rejects.
BreakingFeaturesv4.1.2
Release v4.1.2 updates the package version and adds a new GitHub Actions workflow to handle releases. The release notes only mention enabling trusted publishing, but the diff shows additional changes to the release automation configuration.
v4.1.1
Release v4.1.1 is primarily a tooling and CI update, with development dependency bumps and a migration of TypeScript type tests from tsd to tstyche. It also updates GitHub workflows (including concurrency and a new lock-threads scheduled workflow) and refreshes repository configuration files (.npmrc, dependabot).
v4.1.0
v4.1.0 adds a new streaming option, highWaterMark, and documents it in the public API. It also includes CI workflow permission adjustments and a dev dependency bump (tsd). Code changes show highWaterMark is wired into the underlying fs.createReadStream configuration and covered by new tests.
Featuresv4.0.0
v4.0.0 drops Node 18 support and updates the repository to modern tooling, including switching tests to Node's built-in test runner and renaming CI/fixtures related to branch and scanner behavior. The release notes mostly describe these operational changes, with no runtime/library code diff shown in the provided changes.
Breakingv3.3.1
v3.3.1 is a small release focused on developer tooling and type-definition hygiene. It updates the TypeScript declarations to use the `node:` prefix for built-in modules and refreshes linting configuration, along with minor README and test changes.
v3.3.0
v3.3.0 introduces a new send option, `maxContentRangeChunkSize`, intended to cap how much content is returned for HTTP range requests when range support is enabled. The implementation updates TypeScript types and docs, and adds tests covering several capped-range scenarios.
Featuresv3.2.0
v3.2.0 introduces a new `contentType` option to control whether `Content-Type` is set for served static files. It also changes the charset casing in generated `Content-Type` headers from `UTF-8` to `utf-8` and updates some package metadata and CI workflow references.
BreakingFeaturesv2.1.1
Release v2.1.1 primarily documents CI adjustments, several dev dependency bumps, a small performance tweak for builtin imports, and an XSS security fix related to template injection in the v2.x line. The provided code diff, however, shows only a change to the redirect HTML content in SendStream and the corresponding test expectations.
Securityv3.1.1
v3.1.1 includes a dependency maintenance bump (tap, @types/node, and the fastify/workflows CI plugin) plus a security fix for XSS via template injection. However, the actual code changes between the previous version and v3.1.1 show a much larger API rewrite than what the release notes describe.
Securityv3.1.0
v3.1.0 enhances @fastify/send to return a richer result object so callers can implement custom handling for returned outcomes (file, directory, and error). The TypeScript types and runtime behavior were updated to include a discriminant `type` plus a `metadata` object, enabling custom logic like directory listing and custom error responses.
Featuresv3.0.0
v3.0.0 includes several CI and development dependency bumps, plus a “new implementation” refactor. However, the code diff shows a major public API change: the previous `SendStream` class based API is removed and `send()` now returns a Promise with `{ statusCode, headers, stream }` instead of an event emitter stream that supports `.pipe(res)` directly.
BreakingFeatures