@fastify/static is a Fastify plugin for serving static files, designed to be as fast as possible. It lets you mount a filesystem directory under a URL prefix and control options like cache headers, wildcard routing, and directory redirects.
Project status
- Actively maintained, with an upstream push on 2026-10-28 and updates as recently as 2026-10-27.
- Updates have been frequent, often roughly weekly or every few weeks from July through October 2026.
AI summary generated
Recent updates
v10.1.10
Version 10.1.10 standardizes errors for forbidden static-file paths using @fastify/error. Forbidden-path errors now include the code FST_STATIC_FORBIDDEN_PATH and expose statusCode instead of the previous status property.
Breakingv10.1.9
v10.1.9 fixes static-file fallback behavior for directories without an index file and for pre-compressed files across multiple roots. It also updates the `glob` dependency and pins the release workflow to a newer reusable workflow revision.
v10.1.8
The release notes announce documentation for the `dotfiles` option and its `'allow'` default. The code also adds `onFile` support, rechecks `allowedPath` against the final selected file, and updates error handling and the `@fastify/send` dependency.
SecurityFeaturesv10.1.7
v10.1.7 fixes Fastify Static so files and directories whose names include `#` or `?` can be served and correctly linked from directory listings. The change updates URL pathname decoding for request handling and adjusts HTML `href` generation in the directory listing output.
v10.1.6
Release v10.1.6 updates the project publication pipeline. The release notes state CI is changed to enable trusted publishing using OIDC.
v10.1.5
v10.1.5 includes a targeted fix for how relative paths are resolved when using `reply.download()`. The release notes describe switching to the plugin's registered root for relative downloads.
v10.1.4
v10.1.4 is a security-focused release for @fastify/static (GHSA-r799-r9gc-m956, CVE-2026-90982) that addresses a bypass involving route guards and allowedPath behavior on case-insensitive filesystems. The code introduces new path spelling validation logic, adding additional forbidden checks before authorization and before serving files, including checks related to pre-compressed variants.
BreakingSecurityv10.1.3
v10.1.3 primarily contains chore-level dependency and workflow updates per the release notes. However, the actual code diff adds new non-canonical path detection and introduces stricter request rejection logic in fastify-static, which changes observable HTTP behavior for certain “odd” URL path forms.
BreakingSecurityv10.1.2
v10.1.2 is a security-focused release with CI workflow action pinning to a commit hash. The code diff also introduces a functional change affecting how the `allowedPath` option is evaluated against the request pathname.
Securityv10.1.1
v10.1.1 is a security release that addresses GHSA-83w8-p2f5-377r. The only other documented change is a README typo fix, but the code diff shows additional security hardening around dot-dot (.. ) path segments and how such requests are rejected.
Securityv10.1.0
v10.1.0 adds proper cache variation handling for pre-compressed static responses by setting Vary: Accept-Encoding when `preCompressed` is enabled. It also introduces `suppressWarning` and switches option validation errors to structured errors created with `@fastify/error` (custom error codes and types).
Featuresv10.0.0
v10.0.0 of @fastify/static introduces a breaking API change for the `setHeaders` option, switching it from a raw response object to a Fastify `reply` so it can use reply helper methods. It also updates handling around precompressed encodings (notably deflate) and bumps `content-disposition`.
Breakingv9.3.0
Release v9.3.0 is a small change focused on updating the @fastify/static dependency on fastify-plugin. The only code diff is a dependency version bump in package.json, from fastify-plugin v5 to v6.
v9.2.0
v9.2.0 updates @fastify/static with a runtime fix to propagate the return value from Fastify's error handler, plus several documentation and developer tooling changes. It also bumps @fastify/compress and @types/node, and migrates the TypeScript type-test setup from tsd to tstyche.
v9.1.3
v9.1.3 fixes wildcard prefix handling when the Fastify route prefix contains route parameters (for example, prefixes like /app/:version with wildcard paths). The implementation changes how the plugin derives the “remainder” path from the raw request URL for wildcard routes, replacing simple string prefix matching with a route-prefix matcher that understands Fastify-style :params.
v9.1.2
v9.1.2 contains a targeted fix intended to resolve wildcard path handling when fastify-static is registered inside encapsulated contexts (such as nested plugins with a mount prefix). The release notes describe only this behavior change.
v9.1.1
v9.1.1 is a security-focused release for @fastify/static, fixing CVE-2026-6410 and CVE-2026-6414. Besides a CI workflow addition, the code diff shows significant changes to how request URLs and directory listing paths are normalized and validated to prevent path traversal and related edge cases.
BreakingSecurityFeaturesv9.1.0
v9.1.0 updates various dev dependencies and CI tooling, and includes a bug fix for sendFile behavior related to how options are applied. The code diff also shows broader internal plumbing changes to pass option data through file-serving fallbacks, plus additional tests for multiple roots. Some TypeScript declaration header/reference changes are not called out in the release notes.