npm / @nestjs/core
@nestjs/core
What changed in @nestjs/core 10 to 12, from its official release notes, upgrade guides and advisories. Also covers @nestjs/common. Sources checked 2026-10-17.
@nestjs/core 12203 changes
Breaking changes 23
Every event handler runs when a sibling completes empty.
ParseArrayPipe rejects arrays nested in item values.
Request-scoped global enhancers now fail explicitly at startup instead of being silently dropped.
Every pending request now fails when a callback throws.
Pending RMQ requests now fail when the client closes.
Pending requests now fail when the client closes.
Plain handler results are no longer flattened when pre-request hooks are used.
Requests now fail when their reply subscription is rejected.
The angular schematic has been removed.
ArgumentMetadata is now generic, requiring adjustments to some hand-written custom pipe signatures.
Plain objects after log messages are now attached as structured parameters by default; structuredParams false restores prior behavior.
Core Nest packages are now ESM-only, while CommonJS applications can continue using them through require(esm).
GraphiQL is now the default GraphQL IDE, and customization uses an options object.
Throwing HealthCheckError no longer reports unhealthy health checks.
The legacy health indicator base class has been removed; custom indicators must use HealthIndicatorService.
Lifecycle hooks are now invoked by component hierarchy level, which may change ordering assumptions.
The NATS transport package replaces nats; direct imports and message handling must be updated.
NATS packets are serialized as JSON strings, and custom deserializers receive the full message object.
CLI generation and upgrade commands require Node.js v22.22.3+, v24.15+, or v26+.
NestJS 12 requires Node.js 20.19+ or 22.12+; the 21.x line is unsupported.
Optional constructor parameter markers are no longer inherited by subclasses.
GraphQL subscriptions transport support was removed; clients must switch to graphql-ws.
Joi-specific validation settings must be moved under validationOptions.libraryOptions.
Security 6
useSecurityHeaders() turns off Express x-powered-by.
NestJS adds built-in CSRF protection.
NestJS adds built-in security headers.
Memory held for a TCP peer is now bounded.
Platform Fastify fixes middleware bypass for absolute-form request targets.
Nest: Remote process termination via a deeply nested microservice message pattern
Deprecations 3
Terminus built-in indicator timeout options are deprecated in favor of chaining withTimeout on the returned attempt.
The webpack CLI workflow is deprecated in favor of --builder rspack.
The webpack path flag is deprecated in favor of selecting the Rspack builder.
New APIs and options 40
Express and Fastify file uploads support array index limits.
Express and Fastify file uploads support field nesting limits.
Upload limits now support field nesting and array indexes.
Fastify can listen on a socket path.
Exports deserializers from the microservices package root.
NestJS adds built-in, adapter-agnostic cookie support.
Fastify gains file upload interceptors backed by @fastify/multipart.
Global prefixes now support being provided as an array.
ServerMqtt adds maxConnectionAttempts to configure the maximum connection attempts.
CLI builds should select Rspack with the builder option as webpack workflows are deprecated.
Kafka event patterns now accept RegExp values.
JSON logging can spread structured parameters into the root instead of nesting them under params.
graphql-ws is the supported GraphQL subscriptions transport.
WebSocket disconnect handlers can receive the disconnection reason.
Exceptions can serialize a stable error code so clients avoid parsing message strings.
Kafka message patterns now accept RegExp values.
A new hook runs before a microservice message handler is invoked.
The SWC builder can emit declaration files through a new CLI flag or nest-cli.json option.
Builds can disable type checking.
Monorepo projects can be built in parallel with configurable concurrency.
Monorepo projects can build in parallel when --parallel is combined with --all.
nest build supports specifying the Rspack path.
Adds a nest-cli.json property for copying library assets into an application build.
A new command deploys applications to the cloud through Mau and installs @nestjs/mau on first use.
The upgrade command can report planned changes without modifying project files.
The application accepts an instrument option for integrating the official observability SDK with Nest's lifecycle.
The new SDK provides native observability for requests, jobs, errors, traces, and supported transports.
Projects switching to ESM set package.json type to module.
Kafka message and event patterns can now use regular expressions.
Request-scoped WebSocket gateways can inject the socket through the REQUEST token.
Route parameter decorators accept Standard Schema-compatible schemas for validation and OpenAPI generation.
Applications can opt into errors for duplicate route conflicts.
NestApplicationOptions can configure duplicate and shadowed route diagnostics.
Applications can opt into warnings when declaration order causes one route to shadow another.
Applications can opt into specificity-based route resolution.
nest build and nest start accept a Rspack configuration path.
Compiler informational logs can be suppressed.
A new interceptor validates and transforms outgoing responses using Standard Schema.
A new pipe validates route data against Standard Schema metadata.
Adds errorFormat to control validation error response shape as list or grouped.
Behavior and default changes 17
Omitted WebSocket adapter creation options receive defaults.
Omitted WebSocket adapter creation options receive defaults.
SSE responses now send the expires header.
Transient global enhancers now run on controllers.
Global scoped enhancers are resolved per connection.
A redeclared @Inject() property replaces the inherited property.
Request-scoped hooks use the hook name as their pattern.
Server options now receive defaults like the client factory does.
TCP connections wait for the TLS handshake.
useClass() overrides now take the scope of the class.
validationSchema now accepts any compatible Standard Schema instead of being Joi-specific.
All core Nest packages now ship as ESM while existing CommonJS applications generally continue working.
The Express adapter now drains in-flight requests during shutdown.
The Express adapter drains in-flight requests during shutdown.
GraphiQL is now the default GraphQL IDE, replacing playground configuration.
Error mapping was reworked across core, Express, and Fastify adapters.
Rspack is now the default bundler for monorepos.
Tooling 6
bun is now supported as a package manager alongside npm, yarn, and pnpm.
The project generator now asks whether to scaffold a CommonJS or ESM project.
A new command upgrades v11 projects to v12 and applies supported migration steps.
Generated projects now use oxlint instead of ESLint.
The decorator schematic now generates decorators using Reflector.createDecorator().
Vitest is the default test runner for generated ESM projects, while CommonJS projects retain Jest.
Fixes and other changes 108
Fastify async lifecycle hooks settle only once.
Async request hook completion is guarded.
Buffered logs are flushed when application initialization fails.
Client-streaming calls receive an answer when handlers return nothing.
Dependencies of configurable module aliases are collected.
Custom decorator data is retained when it has schema or pipes keys.
Client operations survive custom deserializer errors.
Import error messages now name dynamic host modules.
Minified exception class names fall back to Error.
Method misses are answered on excluded routes.
Method misses are answered on excluded routes.
File type regular-expression state is isolated.
Gateway lifecycle hook errors are passed to exception filters.
A GET middleware exclusion also covers HEAD requests.
Global prefix exclusions are honored for overlapping versions.
Global scoped enhancers are resolved separately for each connection.
gRPC response errors no longer enter the request stream.
Empty-completing gRPC stream calls now resolve.
isHeadersSent counts headers flushed through reply.raw.
Both Kafka client connections close when one fails.
Kafka records are cloned before serialization.
Pending Kafka requests fail when deserialization errors occur.
Null payloads are preserved in Kafka tombstone records.
Fastify listen() rejects invalid ports.
Records returned by message handlers are unwrapped.
Controller paths are normalized when middleware is mapped.
MQTT payload options are preserved.
MQTT requests fail when publishing fails.
NATS requests fail on undecodable replies.
Stale NATS status events are ignored.
NATS status updates continue when a listener throws.
Inherited @Optional() properties remain optional.
Redis operations wait for both clients to be ready.
Redis connections no longer crash the process when they drop.
Redis listen operations fail when subscriptions are rejected.
Explicit null values are preserved in reflectable decorators.
Fastify shutdown hooks honor return503OnClosing.
The RabbitMQ client no longer opens two channels on connect.
RabbitMQ connect and listen operations fail on channel setup errors.
RabbitMQ # wildcards match in any position.
Custom Fastify router constraints are preserved.
The pattern is included when a scoped handler fails to resolve.
Shared contexts are retained during disconnect hooks.
Shared contexts are retained during disconnect hooks.
The shutdown sequence runs after initialization fails.
A shutdown signal received while close() is running is honored.
Assigning an SSE event id no longer mutates the message.
Headers are committed for empty SSE streams.
SSE lifecycle state settles correctly after an early disconnect.
Handler-set status and headers are sent on SSE responses.
SSE streams end when event data cannot be serialized.
The StreamableFile source is destroyed when a client disconnects.
Pending TCP retries are canceled when the connection closes.
Nested transient providers injected into properties are isolated.
Default Fastify body parsers remain available after useBodyParser().
Overrides take the scope of the class.
Parent validation constraints are preserved.
VERSION_NEUTRAL middleware routes are treated as having no version.
URI versioned exclusions are resolved correctly for the not-found handler.
The base WebSocket exception filter copies the options object.
Wildcard middleware runs on the bare global prefix path.
Detects circular dependencies across more than two providers.
Keeps a newer Kafka connection when a stale connection fails.
Fixes JSON output, log level changes, fatal logs, and buffered logs.
Allows the MQTT client to retry after a failed connection.
Recovers the NATS client after it gives up reconnecting.
Keeps a newer NATS connection when a stale connection fails.
Rejects non-numeric items when ParseArrayPipe uses Number items.
Replies on the request channel when Redis wildcards are enabled.
Treats JSON content types with parameters as JSON in reply().
Allows the RMQ client to retry after a failed connection.
Preserves string enum values that match numeric member names.
Ignores events emitted by a replaced TCP client socket.
Preserves TCP event listeners across reconnects.
Honors class and factory overrides of value providers.
Fastify initialization now honors Nest's forceCloseConnections setting.
Invalid metadata entries now include the module name in the resulting diagnostic.
Optional constructor parameters are inherited when the constructor is not redeclared.
The ParseDatePipe default now applies to every missing value.
The Redis client retries after a failed connection.
Route handler names are preserved.
Subsequent middleware is no longer skipped after a transient middleware.
Sparse factory inject arrays no longer cause the application to hang.
Missing gRPC package namespaces are handled gracefully.
The Kafka client retries after a failed connection.
Message handler rejections are routed to handleError.
Multer limits are merged key-by-key instead of being overridden wholesale.
Parse date pipe options are optional.
The processing hook envelope is shared across transports.
Kafka request-response spans are closed exactly once.
Request-response spans are closed exactly once.
The Kafka processing end hook now always runs.
Open TCP sockets are now destroyed during shutdown.
The proto-key stripping hook is now invoked via this during transformation.
UUID version and variant are now validated when no version is set.
Fastify derives a neutral version when the accept header is absent.
Factory providers using discovery decorators are now discovered.
Message streams now remain alive when a handler throws.
Responses are now sent for exceptions thrown from middleware.
The MQTT listen callback now runs only once.
normalizePath now collapses duplicate internal slashes.
An empty string is now treated as array input by ParseArrayPipe.
Foreign JSON is no longer treated as an RPC envelope.
Repeated shutdown signal listeners are cleaned up.
Connected microservices now detach signal listeners correctly.
Error instances with statusCode are no longer incorrectly treated as HTTP errors.
UUID v3 variant validation is corrected.
gRPC exception handling now maps errors to proper gRPC status codes instead of UNKNOWN.
@nestjs/core 11103 changes
Breaking changes 3
Numeric enum validation no longer includes reverse-mapped keys.
get() now throws for implicitly request-scoped dependency trees.
Fastify top-level options are migrated to routerOptions.
Security 9
Updated multer to address CVE-2026-88932 in @nestjs/platform-express.
Hardened the TCP transport against a hostile peer.
Nest: Middleware Bypass on Fastify via Trailing Slash
jsonsocket.handledata no longer causes a stack overflow.
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
SSE message handling now sanitizes messages.
Nest Fastify HEAD Request Middleware Bypass
Fixes a Fastify middleware bypass vulnerability.
Fixes middie bypassing through decoded characters in platform-fastify.
New APIs and options 18
NestJS now supports the HTTP QUERY method across core, common, and Fastify.
Server-sent events now support an SSE signal.
File type validation adds an override mimetype option.
Server-sent events support comments.
MulterOptions gains defParamCharset for configuring parameter character encoding.
Microservices add an option to return buffers for binary data.
Microservices handle RMQ blocked and unblocked connection events.
Microservices adds Redis driver identification for applications using Redis transport.
Microservices support a configurable maximum buffer size.
MQTT supports configuring QoS per handler.
An option for async logger compatibility was added.
FileTypeValidator gains a message property for customizing validation messages.
Server-side keepalive support was added for microservices.
SSE handlers now support Promise<Observable> return values.
The @sse decorator now accepts method options.
WebSockets supports manual acknowledgement handling through the @Ack decorator.
The console logger gains a force-console option.
A TCP exception was added for handling TCP receive errors.
Behavior and default changes 2
The legacy route path warning now includes the auto-converted route.
NestJS now warns when a WebSocket adapter is registered late.
Fixes and other changes 71
Multer errors are mapped by code instead of message, restoring 400 responses for unexpected file field names.
Microservices now handle unserializable patterns without crashing.
Fixes an issue involving circular durable providers.
Fixed bootstrap crashes with nestjs-cls proxy providers caused by ProxyProviderNotResolvedException on CLS_REQ.
Fixed ObserveInstrument breaking application startup in @nestjs/core 11.2.x.
Fixed an early-return issue affecting SSE abort behavior.
Pre-registered dynamic imports of lazy modules are now scanned.
Inherited middleware no longer receives a duplicated route prefix.
Adjacent wildcard segments are now converted correctly in legacy routes.
Middleware now runs on routes excluded from the global prefix.
Existing singleton providers are now shared with lazily loaded modules.
String file types containing regex metacharacters are now matched correctly.
A barrier resolves immediately when its target count is zero.
Middleware overlap regexes no longer use the global flag.
The gRPC client is nullified on close when tryshutdown fails.
Import lookup stops after the first direct export match.
Express maps missing Multer field nesting errors correctly.
Express now maps missing Multer field-nesting errors correctly.
The pub/sub client type used in Redis listeners is corrected.
The SSE retry field is serialized when its value is zero.
Missing exception classes are now included in HttpErrorByCode.
Teardown now triggers for the SSE producer Observable when a client disconnects with an interceptor.
The type guard now checks the value rather than the key.
Fixed middleware handling for routes with an ending slash.
Fixed teardown issues affecting SSE async handlers.
Fixed empty responses from POST SSE endpoints.
The ending slash is removed from pathnames in the Fastify platform.
Pending Redis requests are rejected when microservices close.
The SSE close listener is registered before asynchronous setup.
The dependency-tree cache now resets when metadata changes, preventing stale dependency information.
Fixes snapshot: true eagerly instantiating Terminus transient indicators since 11.1.20.
Fixed an inflight request injection bug in core.
Invalid-class-module errors now identify the decorator type.
Skipped provider initialization is now settled correctly.
bindMessageHandlers no longer duplicates the disconnect listener.
Deeply nested transient providers now resolve correctly.
The filetype validator buffer message is corrected.
The parse date pipe now accepts a zero timestamp.
ServerRMQ no longer crashes at boot when @MessagePattern(undefined) is combined with wildcards: true.
@Sse no longer loses events when the stream completes.
SSE message IDs now use strict null checking.
SSE writehead output is deferred until after the lifecycle completes.
The consumer CRASH event listener now uses its backing field.
Prevents the injector from hanging when design:paramtypes metadata is missing.
Fixes a dependency injection edge case involving ModuleRef.create.
NATS serializer behavior now preserves packet headers.
Middleware now auto-runs for HEAD requests because Fastify redirects them to GET handlers and otherwise skips middleware execution.
Fixed a double callback when isdisposed or err is truthy in microservices.
Introduces limits for pattern depth and object complexity in microservices handling.
Fixes pattern matching when indexOf returns 0, preventing a valid result from being treated as falsy.
Introduces object complexity limits for microservices processing.
Prevents the logger from printing an invalid context when no stack trace is provided.
Changes the requestOrigin type.
The maxArrayLength option is no longer skipped.
The maxStringLength option is no longer skipped.
Built-in primitives are excluded when stripping prototype keys.
Fixed a regression in loading file-type under Windows OS.
Adds a missing catch handler for forward-ref provider resolution.
fallbackToMimetype now works without a buffer.
Error handling in FileTypeValidator was improved.
The gRPC stream method return type was corrected.
Nested transient providers are now instantiated correctly in static context.
resolve() now resolves all providers when used with the each option.
ValidationPipe behavior was enhanced.
Nested transient providers are now isolated correctly.
Console logger options now check whether color output is allowed.
Dependency resolution errors now provide improved error messages.
Extras are resolved in configurable module builder asynchronous methods.
Lifecycle hooks are skipped for transient services that are not instantiated.
RabbitMQ microservice fanout binding was fixed.
The parameter type in the RouteConstraints decorator was corrected.
@nestjs/core 102 changes
Security 2
Updated to 1.20.4 to address CVE-2025-15284.
Updated Express to address CVE-2025-15284.