NestJS changelog

@nestjs/common fix(common): reject non-numeric items in ParseArrayPipe with items Number — backport of #17876 fix(common): reject arrays nested in ParseArrayPipe items — backport of #18073 fix(common): skip array holes when stripping protot

@nestjs/platform-express fix(deps): update dependency multer to v2.4.0 [security] — fixes CVE-2026-88932 (GHSA-3pph-fpjx-jg34) fix(express): map multer errors by code instead of message — backport of #17769; a file sent under an unexpected

@nestjs/microservices fix(microservices): harden the tcp transport against a hostile peer

fix(microservices): handle unserializable patterns without crashing fix(platform-fastify): absolute-form request target middleware bypass

fix(core): circular durable providers issue by @kamilmysliwiec in https://github.com/nestjs/nest/pull/17563

fix(core): ObserveInstrument breaks app startup with @nestjs/core@11.2.x #17554 by @kamilmysliwiec fix(core): Bootstrap crashes with nestjs-cls proxy providers (ProxyProviderNotResolvedException on CLS_REQ) #17553 by @kamilmysliwiec

fix(core): early-return SSE abort issue by @kamilmysliwiec

fix(core): share existing singleton providers with lazily loaded modules by @shariyerShazan in https://github.com/nestjs/nest/pull/17430 fix(common): match string file types containing regex metacharacters by @Jaybhade in https://github.com

fix(core): stop import lookup after first direct export match by @malekelkssas in https://github.com/nestjs/nest/pull/17141 chore: update multerExceptions constant by @bo0tzz in https://github.com/nestjs/nest/pull/17328 fix(microservices):

Bug fixes core #17239 fix(core): trigger teardown of SSE producer Observable on client disconnect with interceptor (@jyx-07) common #17257 fix(common): Add missing exception classes to HttpErrorByCode (@Se3do) websockets #17188 fix(websocke

fix(core): sse async handlers teardown issue by @kamilmysliwiec in https://github.com/nestjs/nest/pull/17131 fix(platform-fastify): forRoutes middleware ending slash by @kamilmysliwiec in https://github.com/nestjs/nest/pull/17138

fix(core): post sse endpoint empty response #17098 by @kamilmysliwiec in https://github.com/nestjs/nest/pull/17099

fix(microservices): reject pending Redis requests on close by @yudin-s in https://github.com/nestjs/nest/pull/17024 fix(core): register SSE close listener before async setup by @fallintoplace in https://github.com/nestjs/nest/pull/17018 fix

Bug fixes core #17009 fix(core): reset dependency-tree cache on metadata changes (@puneetdixit200) Enhancements core #16997 feat(core): warn on late websocket adapter registration (@hbinhng) Dependencies platform-ws #17011 chore(deps): bump

Bug fixes core https://github.com/nestjs/nest/issues/16998 fix snapshot: true eagerly instantiates Terminus transient indicators since 11.1.20 Committers: 1 Kamil Mysliwiec (@kamilmysliwiec)

Bug fixes core #16993 fix(core): inflight request injection bug #16989 (@kamilmysliwiec) Enhancements core #16967 fix(core): identify decorator type in invalid-class-module error (@HarrierOnChain) Committers: 2 Harrier (@HarrierOnChain) Kam

Bug fixes core #16948 fix(core): settle skipped provider initialization (@yudin-s) Committers: 1 Serge Yudin (@yudin-s)

Bug fixes core, testing #16939 fix(core): fix deeply nested transient providers resolution (@kamilmysliwiec) core #16861 fix(core): fix @Sse losing events on complete (@MatthiasBrehmer) #16753 fix(core): defer sse writehead until after life

Bug fixes microservices #16762 fix(microservices): use backing field for consumer CRASH event listener (@burhanharoon) #16764 fix(microservices): prevent stack overflow in jsonsocket.handledata() (@kamilmysliwiec) Committers: 2 Burhan Haroo

Bug fixes microservices #16675 fix(microservices): preserve packet headers in nats serializer (@wwenrr) core #16683 fix(core): prevent injector hang when design:paramtypes is missing (@Youmoo) #16637 fix(core): dependency injection edge cas

Enhancements microservices #16218 feat(microservices): add redis driver identification (@vchomakov) Bugs platform-fastify auto-run middleware for HEAD requests as fastify redirects them to GET handlers (effectively skipping middleware execu

Bug fixes microservices #16506 fix(microservices): fix double callback when isdisposed or err is truthy (@LhonRafaat) Dependencies platform-express #16507 fix(deps): update dependency multer to v2.1.1 (@renovate[bot]) Committers: 2 Lhon (@L

fix(microservices): if indexOf return 0 will if will be falsy by @cuiweixie in https://github.com/nestjs/nest/pull/16401 fix(microservices): introuduce max pattern depth and object complexity by @kamilmysliwiec in https://github.com/nestjs/

Bug fixes platform-fastify #16384 fix(fastify): fastify middleware bypass cve (@kamilmysliwiec) common #16307 fix: logger print invalid context when no stack trace provided (@JulienDuf) Enhancements common #16314 fix(common): change request

Bug fixes common #16230 fix(common): Fix skipping maxArrayLength and maxStringLength option (@chojs23) Enhancements microservices #16286 feat(microservices): support per-handler qos in mqtt (@suuuuuuminnnnnn) #16262 Feat/microservices confi

Bug fixes common #16187 fix(common): regression in loading file-type under Windows OS (@iamkanguk97) Dependencies platform-ws #16161 chore(deps): bump ws from 8.18.3 to 8.19.0 (@dependabot[bot]) common #16155 fix(deps): update dependency fi

Bug fixes platform-fastify #16135 fix(platform-fastify): middie bypassing through decoded chars (@kamilmysliwiec) core #16133 fix(core): add missing catch handler for forward-ref provider resolution (@coti-z) Dependencies platform-socket.io

Bug fixes core #16098 fix(core): instantiate nested transient providers in static context (@mag123c) #16005 fix(core): resolve all providers when using resolve() with each option (@malkovitc) microservices #16072 fix(microservices): fix grp

Bug fixes core #15865 fix(core): make get() throw for implicitly request-scoped trees (@JoeNutt) Enhancements common #15863 feat(common): add method options to @sse decorator (@TomerSteinberg) Dependencies platform-fastify #15899 chore(deps

Bug fixes core #15815 fix(core): ensure nested transient provider isolation (@mag123c) platform-fastify #15831 fix(fastify): Migrate fastify top-level options to routerOptions (@kim-sung-jee) Committers: 2 JaeHo Jang (@mag123c) Seongjee Kim

Bug fixes microservices #15747 Fix/rmq microservice fanout bind (@slon2015) platform-fastify #15732 fix: correct parameter type in RouteConstraints decorator (@thedv91) core #15571 fix(core): skip lifecycle hooks for non-instantiated transi

Bug fixes core #15504 fix(core): fix race condition in class dependency resolution from imported modules (@hajekjiri) #15469 fix(core): attach root inquirer for nested transient providers (@kamilmysliwiec) microservices #15508 fix(microserv

Dependencies platform-express #15425 chore(deps): bump multer from 2.0.1 to 2.0.2 in /packages/platform-express (@dependabot[bot])

Bug fixes platform-fastify #15385 fix(testing): auto-init fastify adapter for middleware registration (@mag123c) core, testing #15405 fix(core): fix race condition in class dependency resolution (@hajekjiri) core #15333 fix(core): Make flat

Bug fixes core #15201 fix(core): gracefully shutdown the app when repl exits (@dzhlobo) Enhancements common #15209 feat: add string array type to disposition (@fjodor-rybakov) common, core #15203 feat(core): defer initialization connected m

Bug fixes microservices #15172 fix(microservices): support custom strategy in async usefactory config (@mag123c) #15166 fix(microservice): prevent error logs during redis client shutdown (@janroker) Dependencies common #15185 chore(deps): b

Bug fixes core #15056 fix(core): HTTP adapter error mapping (@maxbronnikov10) microservices #15062 fix(microservices): ensure all redis and amqp client closes properly (@yatin166) #15032 fix(microservices): ensure all the amqp connections a

Enhancements microservices #14540 feat(microservices): add support for topic exchange (rabbitmq) (@kamilmysliwiec) Committers: 1 Kamil Mysliwiec (@kamilmysliwiec)

Enhancements common #14995 feat(common): Add fallbackToMimetype support in FileTypeValidator (@mag123c) Dependencies platform-fastify #14989 fix(deps): update dependency fastify to v5.3.2 [security] (@renovate[bot]) Committers: 1 JaeHo Jang

refactor(common): Prevent JavaScript being wrapped in eval by @Borewit in https://github.com/nestjs/nest/pull/14974

chore(common): temporarily move file-type to regular deps https://github.com/nestjs/nest/commit/d9a69a32a4d560f82112e63a28c26445d4277c44

fix(common): use file-type to validate file mimetypes by @Chathula in https://github.com/nestjs/nest/pull/14881

Bug fixes platform-fastify #14935 fix(fastify): methods comparison (@johaven) Committers: 1 Johan Legrand (@johaven)

Bug fixes platform-fastify #14511 fix(fastify): adds the non-standard http methods to the instance (@johaven) Committers: 1 Johan Legrand (@johaven)

Bug fixes platform-fastify #14895 fix(fastify-adapter): global prefix exclusion path handling w/middleware (@KyleLilly) microservices #14869 fix(microservices): do not re-create client connection once get client by service name (@mingo023)

Bug fixes core #14803 fix(core): infinite loop on broken circular reference (@kamilmysliwiec) https://github.com/nestjs/nest/pull/14792 dependencies not resolving for request-scoped lazy providers (@anizozina) Enhancements core #14802 feat(

Enhancements platform-fastify #14677 perf: Switch deprecated parser querystring for fast-querystring (@smith558) Dependencies platform-fastify #14711 fix(deps): update dependency @fastify/cors to v11 (@renovate[bot]) platform-ws #14689 chor

Bug fixes microservices #14605 fix(microservices): server send drops emitted value (@shprota) platform-express https://github.com/nestjs/nest/pull/14640 fix(platform-express) respect custom parser middlewares in Express 5 (@luddwichr)

Bug fixes core #14597 perf(core): use topology tree for calculating distance (depth) (@kamilmysliwiec) common #14579 fix(common): revert to original value (swc builders regression) (@kamilmysliwiec) Committers: 2 Kamil Mysliwiec (@kamilmysl

Bug fixes common #14546 fix(common): addLeadingSlash optional group support (@dcharbonnier) platform-express #14574 fix(platform-express) make check for existing middlewares work with Express 5 (@luddwichr) Committers: 4 Ghassen Rjab (@Ghas

Bug fixes core #14523 fix: middleware sort issues (@rbnayax) Committers: 1 @rbnayax

Bug fixes core #14522 fix(core): allow optional named wildcard groups (@kamilmysliwiec) Committers: 1 Kamil Mysliwiec (@kamilmysliwiec)

Bug fixes core #14495 fix(core): global module middleware should be executed first (@kamilmysliwiec) Committers: 1 Kamil Mysliwiec (@kamilmysliwiec)

Article: https://trilon.io/blog/announcing-nestjs-11-whats-new Migration guide: https://docs.nestjs.com/migration-guide 👈 👈 👈 ⚠️ Node v16 and v18 are no longer supported (>= v20 is required). Features common, core, microservices #14142 f