@fastify/multipart is a Fastify plugin that parses multipart content types, exposing uploaded files and form fields via async handlers and iterators. It supports streaming or disk modes, optional in-memory accumulation, and configuration for upload limits, making it useful for implementing file upload endpoints in Fastify applications.
Project status
- Actively maintained: the latest update and upstream push were on 2026-11-02, just days before today.
- Updates have been frequent, generally every few days to a few weeks since mid-2026.
AI summary generated
Recent updates
v10.1.8
v10.1.8 sanitizes uploaded filename extensions before using them in temporary file paths, preventing unsafe filename content from affecting those paths. It also updates a test to wait for temporary-file cleanup before checking that the directory is empty.
Securityv10.1.7
v10.1.7 fixes a multipart parsing issue where a delayed consumer of a file stream could hang after the request body ended in a truncated file part. It also clarifies multipart field validation for single versus repeated field names and updates the reusable release workflow reference.
Securityv10.1.6
v10.1.6 corrects the public TypeScript type for `ajvFilePlugin` so it accepts and returns an Ajv instance, making it compatible with Fastify's `ajv.plugins` option. It also consolidates the type tests and makes an upload-cleanup test more tolerant of asynchronous file deletion.
Breakingv10.1.5
Version 10.1.5 updates the TypeScript definition for multipart file parts. It adds an optional `value` property so an `onFile` handler can assign a decoded value when using `attachFieldsToBody: 'keyValues'`; no runtime implementation changes are shown.
v10.1.4
v10.1.4 includes fixes around multipart limits handling and request lifecycle cleanup. The documented change preserves explicit zero values for limits, and the code also adds new logic to ensure temporary upload files are cleaned up when clients disconnect at specific times.
Securityv10.1.3
Release v10.1.3 updates the GitHub Actions setup for publishing the package. It also bumps the package.json version from 10.1.2 to 10.1.3.
v10.1.2
This release (v10.1.2) adds and improves regression coverage around multipart limit handling, specifically around how busboy errors surface when the request body is fully buffered. It also clarifies in documentation that Fastify's bodyLimit is not enforced as an aggregate limit by the multipart parser, and updates README/type comments about the fileSize default behavior.
v10.1.1
v10.1.1 is presented as a security release with two GHSA advisories addressed. The documented changes also include CI workflow pinning and some maintenance dependency bumps. However, the code diff shows substantive behavior changes in the temp upload saving flow (error handling and cleanup), which are not described in the release notes.
Securityv10.1.0
v10.1.0 includes a fix for multipart iteration where req.parts() could stop early while busboy still had buffered parts. The change also refines error handling around truncated multipart bodies and premature request closure, introducing a new PrematureCloseError for the latter. Alongside runtime changes, the release updates development tooling and some dependencies.
Featuresv10.0.0
v10.0.0 introduces a change to `saveRequestFiles` so callers can receive both the saved file descriptors and the parsed non-file form field values. The release notes also include dependency and CI chore updates, plus minor README and type definition adjustments to match the new return shape.
BreakingFeaturesv9.4.0
v9.4.0 adds support for per-route Busboy configuration via `config.multipartOptions`, allowing route-level limits and other Busboy settings to affect parsing. The release also updates TypeScript typings and documentation, removes a stray console.log from a test, and bumps the development dependency `@types/node` to 25.0.3.
Featuresv9.3.0
v9.3.0 primarily addresses stability for malformed multipart requests by preventing uncaught exceptions. The release also includes CI and project hygiene changes (npmrc script ignoring, dependency pre-commit cleanup, concurrency config) plus README Node.js reference updates.
v9.2.1
v9.2.1 is a small release that updates the package manifest only. The change is centered on dependency classification for `c8`, moving it from runtime dependencies to development dependencies.
v9.2.0
v9.2.0 migrates the project test suite from the tap runner to Node's built-in node:test runner. The diff shows widespread updates across test files to replace tap APIs with node:test equivalents and assertions.
v9.1.0
v9.1.0 is a maintenance release that updates CI configuration (renaming master to main and tightening workflow/job permissions), refreshes license/README metadata, and adds Zod validation documentation via a new example. It also bumps several dependencies, notably fastify-multipart utilities (deepmerge to 3.0.0, secure-json-parse to 4.0.0) and developer tooling types (tsd, @types/node).
BreakingFeaturesv8.3.1
Release v8.3.1 primarily contains dependency bumps (swagger-ui, deepmerge, error, busboy) and a generic fix referenced as PR #567. The provided code diff also shows behavioral changes in multipart file handling and how temporary upload paths are tracked during upload processing.
v9.0.3
v9.0.3 release notes document two changes: switching Dependabot npm updates from weekly to monthly, and fixing a case where temporary files are deleted when a client cancels a multipart upload request. The provided code diff shows additional, substantial implementation and dependency changes that are not mentioned in the release notes, including stream consumption behavior changes and major runtime dependency upgrades.
v9.0.2
v9.0.2 is a maintenance release focused on dependency bumps, style/lint cleanups, and small internal refactors. The only runtime code changes shown are parameter signature simplifications (unused params renamed/removed) and a small optional-chaining tweak for tmpdir selection, with corresponding test updates.