Fasti BPM
Get notified
Coming soonBPM for regulated industries

Every step, on record.

The open-source process platform built on Camunda 7 CE. It runs your BPMN and DMN, records everything that happens, and ships on an engine that keeps getting fixed.

Get notified at launch See what is inside

Illustration of a recorded process instance, not a product screenshot.

5
security fixes
4
stability bugs fixed
14
libraries upgraded
17
Java baseline, up from 11

The Fasti engine, compared with Camunda 7 CE 7.24.0.

Why Fasti

Run it. Read it. Audit it.

Audit by default

Every activity, decision and variable change is written to history as it happens: who did what, when, and with which data.

An engine that moves forward

The Community Edition stopped at 7.24.0. Fasti maintains its own build of that engine, with security fixes and current libraries.

Familiar and open

The same BPMN and DMN, the same org.camunda.* APIs, REST at /engine-rest, PostgreSQL underneath. Apache License 2.0.

The Fasti-maintained engine

Current libraries. Closed holes.

Already in the main branch of the Fasti engine. The Fasti BPM distribution moves to this engine as part of the roadmap.

Upgraded from Camunda 7 CE 7.24.0 to the Fasti engine: minimum Java 11 to 17, Spring Boot 3.5.5 to 4.1.2, GraalJS 21.3.12 to 25.0.5.0.3, Bouncy Castle 1.47 to 1.87, Jackson 2.15.2 to 2.19.4, SLF4J 1.7.36 to 2.0.20, Logback 1.2.13 to 1.6.6.

Security fixes

AuthorizationPermission checks in the monitoring app

With any entry in disabledPermissions, monitoring queries skipped the read-permission check. Permissions are now enforced as configured.

ExpressionsExpressions in task or-queries

Expressions nested in an or-query bypassed the engine's query validator. Every or-query is now validated like the main query.

AuthorizationTask attachments and comments

Four REST endpoints for a single attachment or comment did not check permissions on the task. They now do.

AdministrationFirst-time setup page

The page that creates the first administrator stayed open when administrators were configured outside the default group. It now closes in every case.

RedirectsOpen redirect in a path filter

The trailing-slash filter could send users to another host. It now redirects only for internal paths.

HardeningJavaScript engine options

Process variables named polyglot.js.* are no longer passed to the script engine, so they cannot act as GraalJS options.

Stability fixes

MemoryGraalJS context leak in BPMN scripts

Each JavaScript execution left contexts that were never closed. Each run now uses one context and closes it.

MemoryGraalJS context leak in DMN expressions

The same problem in decision tables that use JavaScript expressions, fixed the same way.

ResourcesHTTP connector responses

Responses are always closed, including when there is no body or when output mapping fails.

FunctionScript results that are objects or arrays

A script task whose resultVariable received a JavaScript object or array always failed. It is now stored as a Java collection.

Compared with Camunda 7 CE 7.24.0 only, and confirmed with regression tests against that release. No CVE identifiers are attached; no performance or memory measurements are published. Requires Java 17 or later.

Roadmap

Where it is going

“Planned” means not released yet; scope and order may change.

  1. In progress

    Foundations

    Runnable distribution, Dockerfile, public release of the source.

  2. Planned

    Operations

    SSO/OIDC, Prometheus and OpenTelemetry, Helm chart.

  3. Planned

    Financial-grade audit

    Immutable audit trail (signed or hashed), audit reports, multi-tenant admin.

  4. Planned

    User experience

    New task list, form builder, web modeler, Vietnamese UI.

  5. Planned

    Extensions

    MCP server, AI steps in processes, connectors for Vietnamese banking.

  6. In progress

    Maintained engine

    Library upgrades, security fixes, a new user interface.

FAQ

Short answers

Is Fasti BPM available today?

Not yet. It is in active development and has not been released publicly. Leave us a note and we will tell you when it launches.

How does it relate to Camunda?

Fasti BPM is built on Camunda 7 Community Edition 7.24.0, the final Community Edition release. It is an independent project, not affiliated with or endorsed by Camunda Services GmbH.

Will existing Camunda 7 processes keep working?

Compatibility is a design goal: Fasti keeps the org.camunda.* packages, the BPMN namespace and the camunda.bpm.* configuration prefix. The Fasti engine does raise the minimum Java version to 17.

What license will it use?

The Apache License 2.0.

Be the first to know

Tell us what you need to solve and we will let you know when Fasti BPM launches.

Email us contact@fasti.dev