@mastra/fastify@1.5.23

⚠ Under review

Mastra Fastify adapter for the server

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The inspected package code showed no confirmed attack behavior, but it imports the required @mastra/server dependency whose source snapshot was unresolved. This prevents a clean verdict.

Static reason

No blocking static signals were detected.

Trigger

Importing the package loads its runtime entrypoint and required dependencies.

Impact

The unresolved dependency prevents confirming whether its behavior introduces an attack surface.

Mechanism

The entrypoint imports server adapter and authentication modules from @mastra/server; the available dependency snapshot could not be inspected.

AI rationale

The inspected package code showed no confirmed attack behavior, but it imports the required @mastra/server dependency whose source snapshot was unresolved. This prevents a clean verdict.

Evidence

package.jsondist/index.js

Decision evidence

public snapshot

AI called this Manual Review at 94.0% confidence as Unknown with medium false-positive risk.

AI review observations

The package declares @mastra/server as a required dependency, and its runtime entrypoint imports that dependency’s server adapter and authentication modules. The provided dependency snapshot is unresolved, so those imported modules could not be reviewed.
The inspected adapter code delegates route authentication and conditionally processes request headers for configured logging; no attack behavior was identified in these excerpts.
The inspected @fastify/busboy snapshot exposes multipart and URL-encoded parsers; its inspected entrypoint contains ordinary stream-parser setup.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 53.2 KB of source

Source & flagged code

6 flagged

package.jsonView file

24"@mastra/server": "1.79.0" }, "devDependencies": { "@ai-sdk/openai": "^2.0.135", "@fastify/swagger": "^9.7.0", "@fastify/swagger-ui":

Low

Suspicious Dependency Evidence

The package declares @mastra/server as a required dependency, and its runtime entrypoint imports that dependency’s server adapter and authentication modules. The provided dependency snapshot is unresolved, so those imported modules could not be reviewed.

package.jsonView on unpkg · L24

dist/index.jsView file

Lines 1-41javascript

1import { Busboy } from "@fastify/busboy";

2import { MastraServer as MastraServer$1, checkRouteFGA, getCustomHTTPExceptionResponse, isSafeObjectKey, isZodError, normalizeQueryParams, redactStreamChunk, serializeStreamChunk } from "@mastra/server/server-adapter";

Low

Suspicious Dependency Evidence

dist/index.jsView on unpkg · L2

3import { RequestContext } from "@mastra/core/request-context";

4import { coreAuthMiddleware, isCustomRoutePublic } from "@mastra/server/auth";

5//#region src/auth-middleware.ts

6function toWebRequest$1(request) {

7 const url = `${request.protocol || "http"}://${request.headers.host || "localhost"}${request.url}`;

8 const headers = new Headers();

9 for (const [key, value] of Object.entries(request.headers)) {

10 if (!value) continue;

11 if (Array.isArray(value)) value.forEach((v) => headers.append(key, v));

12 else headers.set(key, value);

13 }

14 return new globalThis.Request(url, {

15 method: request.method,

16 headers

17 });

18}

19function createAuthMiddleware({ mastra, requiresAuth = true }) {

20 return async (request, reply) => {

21 if (!requiresAuth) return;

22 const authConfig = mastra.getServer()?.auth;

23 if (!authConfig) return;

24 request.requestContext ??= new RequestContext();

25 request.mastra ??= mastra;

26 const path = String(request.url.split("?")[0] || "/");

Low

Ai Review Evidence

The inspected adapter code delegates route authentication and conditionally processes request headers for configured logging; no attack behavior was identified in these excerpts.

dist/index.jsView on unpkg · L21

27 const method = String(request.method || "GET");

28 const customRouteAuthConfig = new Map(request.customRouteAuthConfig ?? []);

29 if (!isCustomRoutePublic(path, method, customRouteAuthConfig)) customRouteAuthConfig.set(`${method}:${path}`, true);

30 const authHeader = request.headers.authorization;

31 let token = authHeader ? authHeader.replace("Bearer ", "") : null;

32 const query = request.query;

33 if (!token && query.apiKey) token = query.apiKey || null;

34 const result = await coreAuthMiddleware({

35 path,

36 method,

37 getHeader: (name) => request.headers[name.toLowerCase()],

38 mastra,

39 authConfig,

40 customRouteAuthConfig,

41 requestContext: request.requestContext,

Lines 375-415javascript

375 if (request.body !== void 0) rawReq.body = request.body;

376 await server.startSSE({

377 url: new URL(request.url, `http://${request.headers.host}`),

.lpm-dependency-evidence-4d3ba84b-a3ec-4764-85b9-2bfcecce4852/0/npm-linux/package.jsonView file

18"main": "index.js", "type": "commonjs", "types": "types/index.d.ts", "scripts": { "bench:busboy": "cd benchmarks && npm install && npm run benchmark-fastify", "bench:

Low

Ai Review Evidence

The inspected @fastify/busboy snapshot exposes multipart and URL-encoded parsers; its inspected entrypoint contains ordinary stream-parser setup.

.lpm-dependency-evidence-4d3ba84b-a3ec-4764-85b9-2bfcecce4852/0/npm-linux/package.jsonView on unpkg · L18

.lpm-dependency-evidence-4d3ba84b-a3ec-4764-85b9-2bfcecce4852/0/npm-linux/index.jsView file

7const MultipartParser = require('./lib/types/multipart') const UrlencodedParser = require('./lib/types/urlencoded') const parseParams = require('./lib/utils/parseParams') function Busboy (o

Low

Ai Review Evidence

The inspected @fastify/busboy snapshot exposes multipart and URL-encoded parsers; its inspected entrypoint contains ordinary stream-parser setup.

.lpm-dependency-evidence-4d3ba84b-a3ec-4764-85b9-2bfcecce4852/0/npm-linux/index.jsView on unpkg · L7

Source & flagged code

6 flagged · loading source

package.jsonView file

24"@mastra/server": "1.79.0" }, "devDependencies": { "@ai-sdk/openai": "^2.0.135", "@fastify/swagger": "^9.7.0", "@fastify/swagger-ui":

Low

Suspicious Dependency Evidence

package.jsonView on unpkg · L24

dist/index.jsView file

2import { MastraServer as MastraServer$1, checkRouteFGA, getCustomHTTPExceptionResponse, isSafeObjectKey, isZodError, normalizeQueryParams, redactStreamChunk, serializeStreamChunk } from "@ma

Low

Suspicious Dependency Evidence

dist/index.jsView on unpkg · L2

21if (!requiresAuth) return; const authConfig = mastra.getServer()?.auth; if (!authConfig) return; request.requestContext ??= new RequestContext(); request.mastra ??= mastra; const p

Findings

7 Low

LowScripts Present

LowSuspicious Dependency Evidencepackage.json

LowSuspicious Dependency Evidencedist/index.js

LowAi Review Evidencedist/index.js

LowAi Review Evidence.lpm-dependency-evidence-4d3ba84b-a3ec-4764-85b9-2bfcecce4852/0/npm-linux/package.json

LowAi Review Evidence.lpm-dependency-evidence-4d3ba84b-a3ec-4764-85b9-2bfcecce4852/0/npm-linux/index.js

Affected versions and remediation

This report applies to @mastra/fastify@1.5.23.

See all versions of @mastra/fastify for other recorded verdicts.

Review the evidence and your use of @mastra/fastify@1.5.23 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 11:57:59.542Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Related packages

More from @mastra

Source & flagged code