
Security News
gem.coop Tests Dependency Cooldowns as Package Ecosystems Move to Slow Down Attacks
gem.coop is testing registry-level dependency cooldowns to limit exposure during the brief window when malicious gems are most likely to spread.
An efficient server implies a lower cost of the infrastructure, a better responsiveness under load and happy users. How can you efficiently handle the resources of your server, knowing that you are serving the highest number of requests as possible, without sacrificing security validations and handy development?
Enter Fastify. Fastify is a web framework highly focused on providing the best developer experience with the least overhead and a powerful plugin architecture. It is inspired by Hapi and Express and as far as we know, it is one of the fastest web frameworks in town.
Create a folder and make it your current working directory:
mkdir my-app
cd my-app
Generate a fastify project with npm init:
npm init fastify
Install dependencies:
npm install
To start the app in dev mode:
npm run dev
For production mode:
npm start
Under the hood npm init downloads and runs Fastify Create,
which in turn uses the generate functionality of Fastify CLI.
If installing in an existing project, then Fastify can be installed into the project as a dependency:
Install with npm:
npm i fastify --save
Install with yarn:
yarn add fastify
// Require the framework and instantiate it
const fastify = require('fastify')({
logger: true
})
// Declare a route
fastify.get('/', (request, reply) => {
reply.send({ hello: 'world' })
})
// Run the server!
fastify.listen(3000, (err, address) => {
if (err) throw err
fastify.log.info(`server listening on ${address}`)
})
with async-await:
const fastify = require('fastify')({
logger: true
})
fastify.get('/', async (request, reply) => {
reply.type('application/json').code(200)
return { hello: 'world' }
})
fastify.listen(3000, (err, address) => {
if (err) throw err
fastify.log.info(`server listening on ${address}`)
})
Do you want to know more? Head to the Getting Started.
Code for Fastify's v1.x is in Branch 1.x, so all Fastify 1.x related changes should be based on branch 1.x.
Note
.listenbinds to the local host,localhost, interface by default (127.0.0.1or::1, depending on the operating system configuration). If you are running Fastify in a container (Docker, GCP, etc.), you may need to bind to0.0.0.0. Be careful when deciding to listen on all interfaces; it comes with inherent security risks. See the documentation for more information.
Machine: EX41S-SSD, Intel Core i7, 4Ghz, 64GB RAM, 4C/8T, SSD.
Method:: autocannon -c 100 -d 40 -p 10 localhost:3000 * 2, taking the second average
| Framework | Version | Router? | Requests/sec |
|---|---|---|---|
| hapi | 18.1.0 | ✓ | 29,998 |
| Express | 4.16.4 | ✓ | 38,510 |
| Restify | 8.0.0 | ✓ | 39,331 |
| Koa | 2.7.0 | ✗ | 50,933 |
| Fastify | 2.0.0 | ✓ | 76,835 |
| - | |||
http.Server | 10.15.2 | ✗ | 71,768 |
Benchmarks taken using https://github.com/fastify/benchmarks. This is a synthetic, "hello world" benchmark that aims to evaluate the framework overhead. The overhead that each framework has on your application depends on your application, you should always benchmark if performance matters to you.
Getting StartedServerRoutesLoggingMiddlewareHooksDecoratorsValidation and SerializationFluent SchemaLifecycleReplyRequestErrorsContent Type ParserPluginsTestingBenchmarkingHow to write a good pluginPlugins GuideHTTP2Long Term SupportTypeScript and types supportServerlessRecommendations中文文档地址
Please visit Fastify help to view prior support issues and to ask new support questions.
Fastify is the result of the work of a great community. Team members are listed in alphabetical order.
Lead Maintainers:
Great contributors on a specific area in the Fastify ecosystem will be invited to join this group by Lead Maintainers.
Past Collaborators
We are currently an incubated project at the OpenJS Foundation.
This project is kindly sponsored by:
Past Sponsors:
Licensed under MIT.
For your convenience, here is a list of all the licenses of our production dependencies:
Express is one of the most popular web frameworks for Node.js. It is known for its simplicity and minimalism. Compared to Fastify, Express has a larger ecosystem and community but may not be as performant due to its less optimized architecture.
Koa is a web framework designed by the creators of Express, aiming to be a smaller, more expressive, and more robust foundation for web applications and APIs. Koa uses async functions to eliminate callbacks and improve error handling. It is less opinionated than Fastify and has a smaller footprint.
Hapi is a rich framework for building applications and services, known for its powerful plugin system. It is designed to be more configurable and to provide a richer set of features out of the box compared to Fastify, which can make it heavier and potentially slower.
Restify is a Node.js web service framework optimized for building semantically correct RESTful web services ready for production use at scale. Restify is similar to Fastify in terms of performance but is more focused on API creation than being a general-purpose web framework.
FAQs
Fast and low overhead web framework, for Node.js
The npm package fastify receives a total of 4,172,433 weekly downloads. As such, fastify popularity was classified as popular.
We found that fastify demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
gem.coop is testing registry-level dependency cooldowns to limit exposure during the brief window when malicious gems are most likely to spread.

Security News
Following multiple malicious extension incidents, Open VSX outlines new safeguards designed to catch risky uploads earlier.

Research
/Security News
Threat actors compromised four oorzc Open VSX extensions with more than 22,000 downloads, pushing malicious versions that install a staged loader, evade Russian-locale systems, pull C2 from Solana memos, and steal macOS credentials and wallets.