Back to Explore

fastify/fastify-cors

GitHub
1 updates · last 90 days1 watchersOpen source

Last release:

@fastify/cors is a Fastify plugin that adds CORS (Cross-Origin Resource Sharing) headers to responses, and it can also register an OPTIONS preflight route. It is useful for configuring which request origins, methods, headers, and credentials are allowed in a Fastify application, with options like `origin`, `methods`, `allowedHeaders`, and `credentials`.

Project status

  • Actively maintained, with recent activity (last upstream push 2026-08-05, and the latest published update v11.3.0 dated 2026-07-08).
  • Update cadence appears steady but not strictly periodic, with updates in 2025-08 (v11.1.0), 2025-12 (v11.2.0), and 2026-07 to 2026-08 (v11.3.0).

AI summary generated

AI-generated from public sources. May be inaccurate. Report

Recent updates

  • v11.3.0

    v11.3.0 is primarily a tooling and CI maintenance release, with dependency bumps and a migration of the TypeScript type tests from tsd to tstyche. The provided code diff also shows only documentation and test assertion adjustments, without any changes to the core CORS runtime logic.

    Breaking

  • v11.2.0

    v11.2.0 adds support for route-level CORS configuration via `config.cors`, allowing per-route overrides of the plugin registration options. The release also includes dev and CI housekeeping (TypeScript/tsd bumps, workflow concurrency, and minor README updates).

    Features

  • v11.1.0

    v11.1.0 primarily adds a new `logLevel` option to suppress logging for the internal CORS preflight `OPTIONS *` route. The release also updates TypeScript typings for this option and bumps some dev dependencies. Code changes indicate an additional behavioral fix around `hideOptionsRoute` handling when using `delegator`, which is not mentioned in the release notes.

    Features

  • v11.0.1

    v11.0.1 mainly performs dependency and tooling maintenance, including TypeScript and a cache library replacement. The only user-facing note in this release is a README correction for the `methods` default documentation.

  • v11.0.0

    This release (v11.0.0) changes the default CORS `methods` behavior to only allow CORS-safelisted methods, which directly affects the `Access-Control-Allow-Methods` header returned on preflight requests. It also includes minor code style refactors in tests (destructured imports).

    Breaking

  • v10.1.0

    Release v10.1.0 primarily adds the ability to disable CORS per route, plus some maintenance updates (dependency bump, CI branch rename, and documentation/test cleanups). The code diff shows a new early-return in the CORS request handler based on route-level configuration, and a small internal refactor in Vary header parsing.

    Features

  • v10.0.2

    v10.0.2 is primarily a dependency and tooling refresh (TypeScript, neostandard, CI workflow updates) plus small README maintenance. The runtime code change is limited to an optional chaining refactor and renaming unused hook parameters to underscore-prefixed variables.

  • v10.0.1

    v10.0.1 is a small release that updates the package version and bumps the Fastify dependency. The only code changes in this diff are in package.json, changing Fastify from the alpha prerelease to the stable v5 range.

  • v10.0.0

    v10.0.0 primarily updates dependencies and modernizes the project test setup by migrating from tap to node:test with c8. It also adds Promise-based origin support types and updates documentation to warn about potential DoS risks when using RegExp or function-based origin matching.

    SecurityFeatures

  • v9.0.1

    v9.0.1 updates @fastify/cors behavior for CORS headers generated from delegated (dynamic resolver) options. The change ensures the response includes the proper Vary: Origin header when using delegated origin configuration.

    Features