
Security News
Deno Goes the Way of the Dinosaur
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.
fastify-ata
Advanced tools
Fastify plugin for ata-validator. Runtime-competitive with the default, 24x faster serverless cold start, Standard Schema V1.
Fastify plugin for ata-validator - JSON Schema validation powered by simdjson.
Drop-in replacement for Fastify's default ajv validator. Standard Schema V1 compatible.
npm install fastify-ata
const fastify = require('fastify')()
const fastifyAta = require('fastify-ata')
fastify.register(fastifyAta)
fastify.post('/user', {
schema: {
body: {
type: 'object',
properties: {
name: { type: 'string', minLength: 1 },
age: { type: 'integer', minimum: 0 },
role: { type: 'string', default: 'user' }
},
required: ['name']
}
}
}, (req, reply) => {
// req.body.role === 'user' (default applied)
reply.send({ ok: true, name: req.body.name })
})
fastify.listen({ port: 3000 })
All your existing JSON Schema route definitions work as-is.
Write plain JSON Schema and get typed route handlers, no builder DSL. Add the AtaTypeProvider and author schemas with defineSchema:
import Fastify from 'fastify'
import fastifyAta from 'fastify-ata'
import { defineSchema } from 'ata-validator'
const app = Fastify().withTypeProvider<fastifyAta.AtaTypeProvider>()
await app.register(fastifyAta)
app.post('/user', {
schema: {
body: defineSchema({
type: 'object',
properties: { name: { type: 'string' }, age: { type: 'integer' } },
required: ['name'],
}),
},
}, (req, reply) => {
req.body.name // string
req.body.age // number | undefined
reply.send({ ok: true })
})
defineSchema preserves the schema's literal types, so request.body, request.query, request.params, and request.headers are inferred from the schema. Same idea as @fastify/type-provider-typebox, from plain JSON Schema.
ata-validator falls back to a pure-JS engine where the native addon is not available (Cloudflare Workers, browsers, Bun), so fastify-ata runs in those environments too.
If you prefer a chainable builder over JSON Schema literals, ata-validator/t emits the same plain JSON Schema under the hood, so route schemas, the type provider, and the AOT path all keep working without an adapter. The migration from TypeBox is one import rename:
import Fastify from 'fastify'
import fastifyAta from 'fastify-ata'
import { t } from 'ata-validator/t'
const app = Fastify().withTypeProvider<fastifyAta.AtaTypeProvider>()
await app.register(fastifyAta)
const Body = t.object({
name: t.string({ minLength: 1 }),
age: t.integer({ minimum: 0 }),
email: t.optional(t.string({ format: 'email' })),
role: t.union([t.literal('admin'), t.literal('user')]),
})
app.post('/users', { schema: { body: Body } }, (req, reply) => {
req.body.name // string
req.body.email // string | undefined
req.body.role // 'admin' | 'user'
reply.send({ ok: true })
})
fastify.register(fastifyAta, {
coerceTypes: true, // convert "42" -> 42 for integer fields
removeAdditional: true, // strip properties not in schema
abortEarly: true, // skip detailed error collection (faster invalid path)
prettyErrors: true, // 400 message carries the ATA code + a did-you-mean
})
With prettyErrors, a failed request returns a compiler-style message instead of the plain ajv text:
body must have required property 'name' [ATA7001] (did you mean `name` instead of `nme`?)
Off by default to keep the ajv-compatible message shape.
abortEarly replaces the error list with a shared stub. Good for public endpoints where only the accept/reject decision reaches the caller. On a 10-property schema the invalid path drops from roughly 15 ns/op to 3.7 ns/op.
fastify.register(fastifyAta) sets the validator compiler in the context it is registered into. Register it on the root instance and it applies everywhere; register it inside a plugin and only that subtree uses ata, while the rest of the app keeps the default validator. Use this when you want ata for some routes and the default for others, or when you are adding ata to an existing app without touching the server construction.
If you want ata to be the validator for the whole server, pass the compiler factory at construction time instead. This is the same schemaController.compilersFactory.buildValidator hook that @fastify/ajv-compiler and joi-compiler use, so the default ajv validator is never built.
const Fastify = require('fastify')
const AtaCompiler = require('fastify-ata/compiler')
const app = Fastify({
schemaController: { compilersFactory: { buildValidator: AtaCompiler() } },
})
app.post('/user', {
schema: {
body: {
type: 'object',
properties: { name: { type: 'string' }, age: { type: 'integer' } },
required: ['name'],
},
},
}, (req, reply) => reply.send({ ok: true }))
The factory mirrors @fastify/ajv-compiler: it defaults to Fastify's own ajv behavior (coerceTypes: 'array', removeAdditional: true, first error only) and reads addSchema registrations for cross-schema $ref. Override through customOptions:
buildValidator: AtaCompiler() // defaults match Fastify's ajv
// per-instance overrides are read from ajv.customOptions, e.g.:
const app = Fastify({
ajv: { customOptions: { coerceTypes: false, allErrors: true } },
schemaController: { compilersFactory: { buildValidator: AtaCompiler() } },
})
Note on memory: this replaces the ajv validator, so it is never instantiated. The ajv module itself can still be pulled into the process by Fastify's serializer (fast-json-stringify uses it to check serialization schemas), independent of which validator you choose. Replacing the validator removes ajv from the request validation path, not necessarily from the module graph.
Drop-in replacement for @fastify/ajv-compiler/standalone. Same API.
const StandaloneValidator = require('fastify-ata/standalone')
// Build phase (once) - compile schemas to JS files
const app = fastify({
schemaController: { compilersFactory: {
buildValidator: StandaloneValidator({
readMode: false,
storeFunction(routeOpts, code) {
fs.writeFileSync(generateFileName(routeOpts), code)
}
})
}}
})
// Read phase (every startup) - load pre-compiled, near-zero compile time
const app = fastify({
schemaController: { compilersFactory: {
buildValidator: StandaloneValidator({
readMode: true,
restoreFunction(routeOpts) {
return require(generateFileName(routeOpts))
}
})
}}
})
ata-validator natively implements Standard Schema V1 - the emerging standard for TypeScript-first schema libraries.
const { Validator } = require('ata-validator')
const v = new Validator(schema)
// Standard Schema V1 interface
const result = v['~standard'].validate(data)
// { value: data } on success
// { issues: [{ message, path }] } on failure
Works with Fastify v5's Standard Schema support, tRPC, TanStack Form, Drizzle ORM.
validatorCompiler using ata-validatordefault values, coerceTypes, removeAdditional during validationAll numbers below are reproducible on M4 Pro / Node 25 with the benchmarks in this repo and in ata-validator/benchmark. Run-to-run noise is roughly +/- 5% at these scales.
| Payload | ajv (default) | ata | delta |
|---|---|---|---|
| valid (10 fields) | ~70,000 req/s | ~70,500 req/s | tied |
| invalid (10 fields) | ~51,000 req/s | ~52,500 req/s | +3% |
| invalid (abortEarly) | ~51,000 req/s | ~52,800 req/s | +3.5% |
HTTP + JSON.parse + routing dominate the pipeline, so validator choice is small on throughput. The real difference is elsewhere.
| Scenario | ajv | ata | delta |
|---|---|---|---|
| Serverless cold start (10 routes, first request) | 12.4 ms | 0.5 ms | 24x faster |
| Startup (200 routes) | 7.0 ms | 2.4 ms | 2.9x faster |
| Invalid validation (with abortEarly) | ~15 ns/op | 3.7 ns/op | 4x faster |
ReDoS pattern ^(a+)+$ | 765 ms | 0.3 ms | immune (RE2) |
Serverless cold start is the scenario that matters for Vercel, Cloudflare Workers, Fly.io and similar platforms. On a long-running box the gap closes, so classic servers will not see a throughput jump.
For browser / edge deployments, ata ships an ata compile CLI that turns a JSON Schema into a self-contained .mjs plus TypeScript declarations.
npx ata compile schemas/user.json -o src/user.validator.mjs --name User
A 10-field schema produces:
| Variant | Raw | Gzipped |
|---|---|---|
| ata runtime bundle | 117 KB | 27 KB |
ata compile standard | 4.9 KB | 1.2 KB |
ata compile --abort-early | 1.3 KB | 0.6 KB |
Generated file has zero runtime dependency on ata-validator. isValid is emitted as a TypeScript type predicate, so consumers get narrowing out of the box.
countValid(ndjsonBuf) validates many messages in one native callMIT
FAQs
Fastify plugin for ata-validator: the same validation behavior as Fastify's default, with route schemas compiled 17 to 21 times faster at boot.
The npm package fastify-ata receives a total of 0 weekly downloads. As such, fastify-ata popularity was classified as not popular.
We found that fastify-ata demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.

Security News
On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust.