Update to cookie version 2 breaks CommonJS

[cberescu]

Prerequisites

• I have written a descriptive issue title
• I have searched existing issues to ensure the bug has not already been reported

Fastify version

5.4.0

Plugin version

11.1.1

Node.js version

22.x

Operating system

Linux

Operating system version (i.e. 20.04, 11.3, 10)

ubuntu 22

Description

After updating the cookie package in #361 commonjs require breaks as cookie package v2 completely migrated to ES Modules (ESM).

I believe this should be reverted and release the changes under a different major version as it is a breaking change

Link to code that reproduces the bug

/

Expected Behavior

No response

[Tony133]

Can you create a minimal reproduction of the problem?

[Tony133]

I’ve created a minimal reproduction using CommonJS and @fastify/cookie v11.1.1, and it seems to be working correctly in my environment (as shown in the attached screenshot). Could you check whether there is a specific configuration in the package.json file or a build step in your project that might be causing the error? If you could provide me with a GitHub repository containing the code that triggers the error, we can look into the issue further.

index.js:

const fastify = require('fastify')({
  logger: {
    level: 'info',
    transport: {
      target: 'pino-pretty',
      options: {
        ignore: 'pid,hostname',
        colorize: true
      }
    }
  }
});


// Register the fastify-cookie plugin
// Note: You must register the plugin before using it in routes
fastify.register(require('@fastify/cookie'), {
  secret: 'my-very-long-and-secure-secret-key', // for signed cookies
  hook: 'onRequest'
});

// Route to set a cookie
fastify.get('/set-cookie', (request, reply) => {
  reply.setCookie('session_id', '123456789', {
    domain: 'localhost',
    path: '/',
    secure: false, // set to true in production (HTTPS)
    httpOnly: true // prevents client-side access to the cookie via JavaScript
  });

  reply.send({ status: 'Cookie set successfully!' });
});

// Route to read a cookie
fastify.get('/get-cookie', (request, reply) => {
  const sessionId = request.cookies.session_id;

  if (!sessionId) {
    return reply.status(404).send({ error: 'Cookie not found' });
  }

  reply.send({ session_id: sessionId });
});

// Start the server
const start = async () => {
  try {
    await fastify.listen({ port: 3000 });
  } catch (err) {
    fastify.log.error(err);
    process.exit(1);
  }
};

start();

// test curl
// curl -c cookies.txt http://localhost:3000/set-cookie
// curl -b cookies.txt http://localhost:3000/get-cookie

package.json:

{
  "name": "fastify-cookie-v2-test",
  "version": "1.0.0",
  "description": "fastify-cookie-v2-test",
  "main": "index.js",
  "scripts": {
    "dev": "node index.js"
  },
  "license": "MIT",
  "type": "commonjs",
  "dependencies": {
    "@fastify/cookie": "^11.1.1",
    "fastify": "^5.10.0"
  },
  "devDependencies": {
    "pino-pretty": "^13.1.3"
  }
}

nodejs v24:

nodejs v22:

[Eomm]

I suspect they run a node.js version older than 20.17

[Tony133]

I suspect they run a node.js version older than 20.17

In the issue description, I see Node.js version 22.x

Should we release version v12.0.0 of @fastify/cookie in addition to version v11.1.1, which has already been released: https://github.com/fastify/fastify-cookie/releases/tag/v11.1.1 ?

[Eomm]

In the issue description, I see Node.js version 22.x

Yes, but did you never run one process thinking about node22, but it was node20? 😄

Let's wait for a feedback before thinking about the next steps

[Tony133]

Yes, but did you never run one process thinking about node22, but it was node20? 😄

Haha, no, not yet! 😅

Let's wait for a feedback before thinking about the next steps

ok 👍🏻

[jablonski]

I run into the following problem with 11.1.1 when deploying to Vercel (running Node 24.18.0):

Error [ERR_REQUIRE_ESM]: require() of ES Module /var/task/node_modules/cookie/dist/index.js from /var/task/node_modules/@fastify/cookie/index.js not supported.

Instead change the require of /var/task/node_modules/cookie/dist/index.js in /var/task/node_modules/@fastify/cookie/index.js to a dynamic import() which is available in all CommonJS modules.

11.1.0 worked without problems on Vercel. I cannot reproduce the issue locally at the moment, Link to the repository is here:

https://github.com/jeasx/jeasx-develop

Maybe related to the issue: I'm using "type":"module" in package.json.

Update: to make things work again on Vercel, the following env var is needed:

NODE_OPTIONS=--experimental-require-module

[climba03003]

I run into the following problem with 11.1.1 when deploying to Vercel (running Node 24.18.0):

It is weird that Node@24.18.0 requires the node flags.
require(ESM) is enable by default in 20.19.0, 22.12.0 and 23.0.0 onward.

It means it is a Vercel runtime problems, you are not runing the node version that Vercel stated.
Edit, confirmed in the Vercel document. It is the runtime disabling the feature.

[jablonski]

Just to add as reference for people running into the same issue: Vercel uses AWS under the hood. Same problem when using AWS Lambda.

https://docs.aws.amazon.com/lambda/latest/dg/lambda-nodejs.html#nodejs-experimental-features

[mcollina]

I think the best approach is to rever cookie@2 and avoid it for the time being

[Tony133]

Come to think of it, typebox had also been converted entirely to pure ESM, just like cookie, and in the type-provider package is configured as follows:

 “type”: “module”,
  “main”: “./dist/cjs/index.js”,
  “module”: “./dist/esm/index.mjs”,
  “types”: “./dist/cjs/index.d.ts”,
  “exports”: {
    “.”: {
      “import”: {
        “types”: “./dist/esm/index.d.mts”,
        “default”: “./dist/esm/index.mjs”
      },
      “require”: {
        “types”: “./dist/cjs/index.d.ts”,
        “default”: “./dist/cjs/index.js”
      }
    }
  },

see here: https://github.com/fastify/fastify-type-provider-typebox/blob/main/package.json#L5

Why not try doing something similar with this package as well?

[mcollina]

No dual publishing. It's a mess to maintain. We can bump cookie with fastify v6.

[climba03003]

I think the best approach is to rever cookie@2 and avoid it for the time being

I am in favor of using the cookie@2 due to the improvement.
Changed to dynamic import if it really cause problems.

[jablonski]

Dynamic import should fix the issue with AWS / Vercel, so I would favour moving forward with cookie@2.