Fastify 5 is stable while main contains 6.0.0-alpha.2
Fastify v5.12.1 is the latest stable release, while the main branch identifies itself as the coming v6 line and its package manifest says 6.0.0-alpha.2. That distinction matters when copying examples or evaluating source. The README sends production users to the 5.x branch. Stable Fastify gives Node applications an HTTP server, routing, hooks, validation, serialization, and logging without imposing a controller or dependency-injection structure on the rest of the codebase.
Our measured checkout at commit 4cdb0c5 came from main and contained 394 files, roughly 77,799 source lines, and 2.9 MB before installation. It is a sizable, focused framework rather than an application generator. Both CommonJS and ESM usage appear in the README. A basic server can register one route and listen with little ceremony, while larger systems can split their behavior into plugins and nested contexts.
Fastify 5 scopes hooks and decorators through plugins
Fastify 5 treats almost everything below the root instance as a plugin. A registered child receives the decorators, hooks, and plugins of its parents, while parents do not automatically see items created inside that child. This encapsulation lets one route group carry authentication or request decoration without leaking it across the server. Wrapping a plugin with fastify-plugin can deliberately share its additions upward when isolation is not wanted.
That model is the main conceptual cost behind a project whose repository had no build target in our run. Express users may initially expect registration to behave like one global middleware chain. In Fastify, registration order, plugin completion, and scope decide what a route can access. The documentation explains the tree with working route examples, but a team should settle a plugin layout early or it may spend time debugging missing decorators that are behaving exactly as designed.
What happened when we ran it
Our sandbox installed 609 npm packages in 66 seconds, leaving 195 MB on disk. The repository defines no general build script or target, so the lab skipped that step rather than pretending a compile occurred. Npm audit reported 0 known vulnerabilities: 0 critical, 0 high, 0 moderate, and 0 low. The checkout also included 20 CI workflow files and a dedicated tests directory.
The test command failed with exit code 1 after 85 seconds. Its captured tail showed passing cases for a stream-generated 404, hostname and port handling, an IPv6 port, Pino stream options, exposure of 95 error definitions, and several WebDAV methods without a content type. It then printed failing tests: without a test name or diagnostic. The log proves the suite failed; it does not show which case failed or why.
A 195 MB contributor install is separate from app setup
Installing Fastify into an application is the familiar npm i fastify, followed by route registration and a call to listen. Core Fastify does not require an account, API key, database, or control plane. The repository's 609-package, 195 MB footprint describes contributor tooling and tests around the framework, not the dependency cost of a new production app. Each official or community plugin can bring its own packages and configuration, so evaluate the actual service lockfile.
Networking has one useful safe default. Fastify listens on localhost unless told otherwise. A container generally needs host: '0.0.0.0', which makes interface exposure an application decision rather than an invisible framework choice. Logging uses Pino, and JSON Schema can validate input and compile response serializers. Those mechanisms are optional, but teams skipping schemas give up much of what separates Fastify from a thinner middleware server.
Version 5 supports current Node LTS lines
The support table lists Node 20, 22, 24, and 26 for Fastify 5. Fastify 6 is listed for Node 24 and 26, with its release date still unset. Major versions receive at least 6 months of support, then security updates for another 6 months after the next major arrives. Versions 3 and older are end of life; commercial extended support is available separately for unsupported lines.
A clean audit with 0 known vulnerabilities does not remove the need to follow releases. Version 5.12.1, published August 18, 2026, is explicitly a security release and fixes 2 advisories alongside route and lifecycle corrections. Fastify also warns that a security fix can require a breaking change in a minor release. Pinning a tilde range can avoid that change, but the LTS guide says doing so can leave the application exposed.
One hundred forty-nine open items accompany daily activity
GitHub showed 37,067 stars and 149 combined issues and pull requests when fetched. The last push was August 31, 2026, and several issue and pull-request threads were updated that day. That is strong evidence of current maintenance, while the combined count should not be read as 149 bugs. The repository dates to September 2016, has a named maintainer team, and routes support questions to a separate help repository.
Fastify's 20 CI workflow files and long support record make the single failed 85-second sandbox test notable rather than a reason to dismiss the framework. For production, choose stable v5, use schemas where they improve correctness, and benchmark the application you will ship. For work on main, first reproduce the unnamed failure and account for the 6.0.0-alpha.2 API surface before proposing a change.