# Risk map — fastify/fastify

> Canonical page: https://codevetter.com/unpack/fastify/risk-map

# Risk map — fastify/fastify

Scanned commit 19d5be0daf1c0daace758efe3ea788f924ca1224 (2026-09-29). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The principal trust boundaries are request bytes, forwarding headers, application-supplied schemas, and plugin code. The source includes explicit defenses and warnings at several of these boundaries. Shutdown and hijacked responses require coordinated resource cleanup across modules. These are source observations and labeled hypotheses, not confirmed vulnerabilities; no whole-repository absence or exploitability is claimed.
- Schemas are a code-execution trust boundary: documentation warns that validation and serialization use new Function and must not accept user-provided schemas. — [docs/Reference/Validation-and-Serialization.md#L18-22](https://github.com/fastify/fastify/blob/19d5be0daf1c0daace758efe3ea788f924ca1224/docs/Reference/Validation-and-Serialization.md#L18-L22)
- The guide warns against database access during initial async validation because of denial-of-service exposure, recommending preHandler instead. — [docs/Reference/Validation-and-Serialization.md#L24-28](https://github.com/fastify/fastify/blob/19d5be0daf1c0daace758efe3ea788f924ca1224/docs/Reference/Validation-and-Serialization.md#L24-L28)
- External header-schema references retain original case and cannot safely be globally normalized; compilation detects them and emits FSTSEC002. — [lib/validation.js#L189-198](https://github.com/fastify/fastify/blob/19d5be0daf1c0daace758efe3ea788f924ca1224/lib/validation.js#L189-L198) [lib/validation.js#L242-249](https://github.com/fastify/fastify/blob/19d5be0daf1c0daace758efe3ea788f924ca1224/lib/validation.js#L242-L249)
- Async validator data is treated as pass/fail rather than unwrapped as error/value, explicitly preventing payload fields from replacing request parts or injecting validation errors. — [lib/validation.js#L309-317](https://github.com/fastify/fastify/blob/19d5be0daf1c0daace758efe3ea788f924ca1224/lib/validation.js#L309-L317)
- Body buffering checks both decoded received length and reported encoded length, with separate declared Content-Length verification. — [lib/content-type-parser.js#L268-283](https://github.com/fastify/fastify/blob/19d5be0daf1c0daace758efe3ea788f924ca1224/lib/content-type-parser.js#L268-L283) [lib/content-type-parser.js#L302-305](https://github.com/fastify/fastify/blob/19d5be0daf1c0daace758efe3ea788f924ca1224/lib/content-type-parser.js#L302-L305)
- JSON parsing delegates prototype and constructor handling to secure-json-parse; tests demonstrate that the ignore option permits observable prototype effects through Object.assign. — [lib/content-type-parser.js#L327-341](https://github.com/fastify/fastify/blob/19d5be0daf1c0daace758efe3ea788f924ca1224/lib/content-type-parser.js#L327-L341) [test/proto-poisoning.test.js#L53-74](https://github.com/fastify/fastify/blob/19d5be0daf1c0daace758efe3ea788f924ca1224/test/proto-poisoning.test.js#L53-L74)
- Forwarded host and protocol are consumed only when proxyFn trusts the direct socket peer, making trustProxy policy security-sensitive. — [lib/request.js#L122-145](https://github.com/fastify/fastify/blob/19d5be0daf1c0daace758efe3ea788f924ca1224/lib/request.js#L122-L145)
- Default error serialization includes error.message, and failed serialization constructs a fallback using both serializer and original error messages. — [lib/error-handler.js#L91-112](https://github.com/fastify/fastify/blob/19d5be0daf1c0daace758efe3ea788f924ca1224/lib/error-handler.js#L91-L112)
- Hypothesis: timeout and hijack changes have broad cleanup risk because routeHandler stores AbortController/timer/socket metadata and Reply.hijack removes associated listeners and metadata. (inferred) — [lib/route.js#L531-564](https://github.com/fastify/fastify/blob/19d5be0daf1c0daace758efe3ea788f924ca1224/lib/route.js#L531-L564) [lib/reply.js#L134-152](https://github.com/fastify/fastify/blob/19d5be0daf1c0daace758efe3ea788f924ca1224/lib/reply.js#L134-L152)
- Alternative-runtime unit CI uses continue-on-error, so its configured failures do not provide the same gating signal as an ordinary mandatory job. — [.github/workflows/ci-alternative-runtime.yml#L25-38](https://github.com/fastify/fastify/blob/19d5be0daf1c0daace758efe3ea788f924ca1224/.github/workflows/ci-alternative-runtime.yml#L25-L38)
- Package-manager CI downloads and pipes a Yarn installer into bash; CITGM derives plugin checkout coordinates from npm registry metadata and runs external package tests. — [.github/workflows/package-manager-ci.yml#L70-79](https://github.com/fastify/fastify/blob/19d5be0daf1c0daace758efe3ea788f924ca1224/.github/workflows/package-manager-ci.yml#L70-L79) [.github/workflows/citgm-package.yml#L77-105](https://github.com/fastify/fastify/blob/19d5be0daf1c0daace758efe3ea788f924ca1224/.github/workflows/citgm-package.yml#L77-L105)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)