chore(deps): update dependency @nestjs/platform-fastify to v11.2.4 [security]

[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@nestjs/platform-fastify (source)	11.1.6 → 11.2.4

---

Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)

CVE-2025-69211 / GHSA-8wpr-639p-ccrj

More information

Details

A NestJS application is vulnerable if it meets all of the following criteria:

1. Platform: Uses @nestjs/platform-fastify.
2. Security Mechanism: Relies on NestMiddleware (via MiddlewareConsumer) for security checks (authentication, authorization, etc.), or through app.use()
3. Routing: Applies middleware to specific routes using string paths or controllers (e.g., .forRoutes('admin')).
   Example Vulnerable Config:

// app.module.ts
export class AppModule implements NestModule {
  configure(consumer: MiddlewareConsumer) {
    consumer
      .apply(AuthMiddleware) // Security check
      .forRoutes('admin');   // Vulnerable: Path-based restriction
  }
}

Attack Vector:

• Target Route: /admin
• Middleware Path: admin
• Attack Request: GET /%61dmin
• Result: Middleware is skipped (no match on %61dmin), but controller for /admin is executed.

Consequences:

• Authentication Bypass: Unauthenticated users can access protected routes.
• Authorization Bypass: Restricted administrative endpoints become accessible to lower-privileged users.
• Input Validation Bypass: Middleware performing sanitization or validation can be skipped.

Patches

Patched in @nestjs/platform-fastify@11.1.11

Resources

Credit goes to Hacktron AI for reporting this issue.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

References

• https://github.com/nestjs/nest/security/advisories/GHSA-8wpr-639p-ccrj
• https://nvd.nist.gov/vuln/detail/CVE-2025-69211
• https://github.com/nestjs/nest/commit/c4cedda15a05aafec1e6045b36b0335ab850e771
• https://github.com/advisories/GHSA-8wpr-639p-ccrj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Nest has a Fastify URL Encoding Middleware Bypass

CVE-2026-2293 / GHSA-r4wm-x892-vjmx

More information

Details

Impact

What kind of vulnerability is it? Who is impacted?

A NestJS application using @nestjs/platform-fastify can allow bypass of any middleware when Fastify path-normalization options (e.g., ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter) are enabled. In affected route-scoped middleware setups, variant paths may skip middleware checks while still reaching the protected handler.

The bug is a path canonicalization mismatch between middleware matching and route matching in Nest’s Fastify adapter.

Nest passes Fastify routerOptions (such as ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter) to the Fastify router in packages/platform-fastify/adapters/fastify-adapter.ts:253.

But middleware execution is decided by a separate regex check over req.originalUrl in packages/platform-fastify/adapters/fastify-adapter.ts:706 and packages/platform-fastify/adapters/fastify-adapter.ts:713.

If that regex does not match, Nest does next() and skips the middleware (packages/platform-fastify/adapters/fastify-adapter.ts:714), while Fastify may still normalize the same path and route it to the protected handler. So the vulnerability exists because security checks (middleware) and request dispatch(router) use different URL interpretations.

This is a fail-open design issue (inconsistent normalization), not just a bad app config: non-default router options make the mismatch reachable.

Patches

Fixed in @nestjs/platform-fastify@11.1.14

References

Credit goes to Fluidattacks (Cristian Vargas) https://fluidattacks.com/advisories/neton

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/nestjs/nest/security/advisories/GHSA-r4wm-x892-vjmx
• https://nvd.nist.gov/vuln/detail/CVE-2026-2293
• https://github.com/nestjs/nest/commit/fd8d073e0e048b185147209338ca7042e52c10ba
• https://fluidattacks.com/advisories/neton
• https://github.com/nestjs/nest/releases/tag/v11.1.14
• https://github.com/advisories/GHSA-r4wm-x892-vjmx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Nest Fastify HEAD Request Middleware Bypass

CVE-2026-33011 / GHSA-wf42-42fg-fg84

More information

Details

Impact

In a NestJS application using @nestjs/platform-fastify, GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers (if they exist).

As a result:

• Middleware will be completely skipped.
• The HTTP response won't include a body (since the response is truncated when redirecting a HEAD request to a GET handler).
• The actual handler will still be executed.

Patches

Fixed in @nestjs/platform-fastify@11.1.16

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/nestjs/nest/security/advisories/GHSA-wf42-42fg-fg84
• https://github.com/nestjs/nest/commit/cbdf737cd6e7cefa52d05ecea2ae4af95c464614
• https://github.com/nestjs/nest/releases/tag/v11.1.17
• https://nvd.nist.gov/vuln/detail/CVE-2026-33011
• https://github.com/advisories/GHSA-wf42-42fg-fg84

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Nest: Middleware Bypass on Fastify via Trailing Slash

CVE-2026-54281 / GHSA-6v32-fjc9-9qf6

More information

Details

Impact

An authentication bypass vulnerability exists in @nestjs/platform-fastify (confirmed on version 11.1.24, the latest available release at time of report). When middleware is registered through NestJS's MiddlewareConsumer.forRoutes() API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (/) to the request URL.

This bypass works on the default Fastify adapter configuration — no special router options need to be enabled. Applications using the standard CRUD route shape (GET /resource and GET /resource/:id) are affected when they protect those routes with MiddlewareConsumer.forRoutes() middleware.

Patches

Fixed in @nestjs/platform-fastify@11.1.24

References

Kudos goes to @​a-tt-om

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/nestjs/nest/security/advisories/GHSA-6v32-fjc9-9qf6
• https://nvd.nist.gov/vuln/detail/CVE-2026-54281
• https://github.com/advisories/GHSA-6v32-fjc9-9qf6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

@​nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

GHSA-9c5c-9qcx-q35q

More information

Details

Field	Value
Ecosystem	npm
Package	@nestjs/platform-fastify
Affected versions	>= 12.0.0, < 12.0.2 and < 11.2.4
Patched versions	12.0.2 and 11.2.4 (upgrade to 12.0.3 / 11.2.5)

Summary

On the Fastify adapter, an HTTP request that uses an absolute-form request target (GET http://host/path HTTP/1.1
instead of GET /path HTTP/1.1) reaches the route handler without running the path-scoped Nest middleware bound to
that route. Applications that enforce authentication or authorization in middleware execute the protected handler
with those checks skipped.

Impact

Any application that

• uses @nestjs/platform-fastify, and
• binds middleware to specific paths via MiddlewareConsumer.forRoutes(...) or .exclude(...), and
• is reachable by a client that controls the raw request line.

Node's HTTP server accepts absolute-form targets, so no special server configuration is needed. Exposure is reduced
when a reverse proxy in front of the application rewrites the request target to origin-form, which most do.

Where the bypassed middleware performs authentication or authorization, the result is an authentication or
authorization bypass. Where it performs logging, rate limiting or body handling, those are silently skipped instead.

Details

Fastify's router (find-my-way) resolves an absolute-form target to its path before matching, so the route handler
is dispatched normally. Two places on the middleware side matched against the raw request target instead:

1. The bundled copy of the @fastify/middie engine at packages/platform-fastify/adapters/middie/fastify-middie.ts.
   NestJS carried this fork to apply an earlier path-decoding fix and it did not track the upstream absolute-form fix
   released in @fastify/middie@9.3.4.
2. FastifyAdapter's own re-check in createMiddlewareFactory(), which tests the middleware path regexp against
   req.originalUrl.

Both normalized and percent-decoded the target, but neither resolved absolute-form to a path, so the router and the
middleware layer disagreed about which path was being requested.

A second, related defect contributed. Because the adapter always passes routerOptions (to install the version
constraint), Fastify did not reflect the deprecated top-level router options (ignoreTrailingSlash,
ignoreDuplicateSlashes, caseSensitive, useSemicolonDelimiter) in initialConfig.routerOptions, which is what
the middleware engine reads. Applications passing those options at the top level had middleware normalize paths
differently from the router, which widened the mismatch.

Proof of concept

@Controller('users')
export class UsersController {
  @Get()
  findAll() {
    return 'protected data';
  }
}

@Module({ controllers: [UsersController] })
export class AppModule implements NestModule {
  configure(consumer: MiddlewareConsumer) {
    consumer
      .apply((req, res) => res.end('blocked by auth middleware'))
      .forRoutes({ path: 'users', method: RequestMethod.GET });
  }
}

supertest and light-my-request always emit origin-form targets, so the request has to be written to the socket:

const { connect } = require('node:net');

const socket = connect(3000, '127.0.0.1', () => {
  socket.write(
    'GET http://127.0.0.1:3000/users HTTP/1.1\r\n' +
      'Host: 127.0.0.1:3000\r\n' +
      'Connection: close\r\n\r\n',
  );
});
socket.pipe(process.stdout);

Observed on an affected version: protected data — the middleware did not run.
Expected, and observed on a patched version: blocked by auth middleware.

Patches

Fixed in 12.0.2 and 11.2.4. Upgrading to 12.0.3 or 11.2.5 is recommended.

• The bundled @fastify/middie fork was removed and the package now depends on @fastify/middie@9.3.4, which
  resolves absolute-form targets before matching.
• The adapter resolves absolute-form targets in its own route check, mirroring find-my-way.
• Deprecated top-level Fastify router options are folded into routerOptions so the middleware engine and the
  router normalize paths identically.

Workarounds

If you cannot upgrade, reject non-origin-form request targets before middleware runs. Register the hook on the
Fastify instance before the application is initialized, so that it runs ahead of the middleware engine's own
onRequest hook, and confirm with the request above that the rejection takes effect:

const adapter = new FastifyAdapter();
adapter.getInstance().addHook('onRequest', (request, reply, done) => {
  const target = request.raw.url ?? '';
  // "*" is the legitimate request target of "OPTIONS * HTTP/1.1"
  if (target[0] !== '/' && target !== '*') {
    reply.code(400).send();
    return;
  }
  done();
});

Rejecting or normalizing absolute-form targets at a reverse proxy in front of the application is equally effective.

Credit

Reported by ZeroVuln Labs.

Severity

• CVSS Score: 7.4 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/fastify/middie/security/advisories/GHSA-hx87-8wv7-pjv8
• https://github.com/nestjs/nest/security/advisories/GHSA-9c5c-9qcx-q35q
• https://github.com/nestjs/nest/pull/17737
• https://github.com/nestjs/nest/commit/5226fe084cf64b357de436f154bc89f2d319b621
• https://github.com/nestjs/nest/commit/dda252090ecb65009d9ff366444303796fc44fd7
• https://github.com/nestjs/nest/releases/tag/v11.2.4
• https://github.com/nestjs/nest/releases/tag/v12.0.2
• https://github.com/advisories/GHSA-9c5c-9qcx-q35q

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

nestjs/nest (@​nestjs/platform-fastify)

v11.2.4

Compare Source

What's changed

• fix(microservices): handle unserializable patterns without crashing
• fix(platform-fastify): absolute-form request target middleware bypass

v11.2.3

Compare Source

What's Changed

• fix(core): circular durable providers issue by @​kamilmysliwiec in #​17563

Full Changelog: nestjs/nest@v11.2.2...v11.2.3

v11.2.2

Compare Source

What's changed

• fix(core): ObserveInstrument breaks app startup with @​nestjs/core@11.2.x #​17554 by @​kamilmysliwiec
• fix(core): Bootstrap crashes with nestjs-cls proxy providers (ProxyProviderNotResolvedException on CLS_REQ) #​17553 by @​kamilmysliwiec

v11.2.1

Compare Source

What's Changed

• fix(core): early-return SSE abort issue by @​kamilmysliwiec

Full Changelog: nestjs/nest@v11.2.0...v11.2.1

v11.2.0

Compare Source

What's Changed

• fix(core): share existing singleton providers with lazily loaded modules by @​shariyerShazan in #​17430
• fix(common): match string file types containing regex metacharacters by @​Jaybhade in #​17435
• fix(core): convert adjacent wildcard segments in legacy route converter by @​eeshsaxena in #​17416
• fix(fastify): run middleware on routes excluded from global prefix by @​Arun445 in #​17377
• fix(fastify): avoid double prefixing inherited middleware by @​GiHoon1123 in #​17350
• fix(core): scan pre-registered dynamic imports of lazy modules by @​johnnyhuirilef in #​17464
• feat(core,common,platform-fastify): add query http method support by @​gacardinal in #​17162
• fix(common): exclude reverse-mapped keys from numeric enum validation in ParseEnumPipe by @​LeSingh1 in #​17086
• test(testing): Add e2e integration tests for HTTP QUERY method (RFC 10008) by @​brayanjeshua in #​17310
• feat(core): sse signal by @​kamilmysliwiec in #​17469
• chore(deps): update dependency fastify to v5.12.0 by @​renovate[bot] in #​17473

New Contributors

• @​shariyerShazan made their first contribution in #​17430
• @​Jaybhade made their first contribution in #​17435
• @​eeshsaxena made their first contribution in #​17416
• @​Arun445 made their first contribution in #​17377
• @​GiHoon1123 made their first contribution in #​17350
• @​johnnyhuirilef made their first contribution in #​17464
• @​gacardinal made their first contribution in #​17162
• @​LeSingh1 made their first contribution in #​17086
• @​brayanjeshua made their first contribution in #​17310

Full Changelog: nestjs/nest@v11.1.29...v11.2.0

v11.1.29

Compare Source

What's Changed

• fix(core): stop import lookup after first direct export match by @​malekelkssas in #​17141
• chore: update multerExceptions constant by @​bo0tzz in #​17328
• fix(microservices): correct pub/sub client type in redis listeners by @​zaewc in #​17331
• feat(common): add override mimetype option to file type validator by @​Ativ3k in #​17333
• fix(core): drop the g flag from middleware overlap regexes by @​dchaudhari7177 in #​17335
• feat(core): support sse comments by @​kyu4583 in #​17327
• fix(core): resolve barrier immediately when target count is zero by @​ikrbasak in #​17393
• fix(common): exclude pipe options from validator options by @​coxxny in #​17399
• fix(core): serialize SSE retry field when value is zero by @​kyu4583 in #​17360
• fix(microservices): nullify grpcclient on close when tryshutdown fails by @​Se3do in #​17394
• fix(express): map missing multer field nesting error by @​Se3do in #​17421

New Contributors

• @​malekelkssas made their first contribution in #​17141
• @​hjc0930 made their first contribution in #​17311
• @​bo0tzz made their first contribution in #​17328
• @​Ativ3k made their first contribution in #​17333
• @​dchaudhari7177 made their first contribution in #​17335
• @​kyu4583 made their first contribution in #​17327
• @​anupamme made their first contribution in #​17378
• @​ikrbasak made their first contribution in #​17393
• @​beiifeng made their first contribution in #​17404
• @​coxxny made their first contribution in #​17399

Full Changelog: nestjs/nest@v11.1.28...v11.1.29

v11.1.28

Compare Source

v11.1.28 (2026-07-08)

Bug fixes

• core
  • #​17239 fix(core): trigger teardown of SSE producer Observable on client disconnect with interceptor (@​jyx-07)
• common
  • #​17257 fix(common): Add missing exception classes to HttpErrorByCode (@​Se3do)
• websockets
  • #​17188 fix(websockets): correct type guard to check value not key (@​Se3do)

Enhancements

• core
  • #​17241 feat(core): include auto-converted route in legacy route path warning (@​ronielli)

Dependencies

• platform-fastify
  • #​17262 chore(deps): bump fastify from 5.8.5 to 5.10.0 (@​dependabot[bot])
• platform-express
  • #​17164 fix(deps): update dependency multer to v2.2.0 [security] (@​renovate[bot])

Committers: 4

• Mohammed Said (@​Se3do)
• Ronielli (@​ronielli)
• greymoth (@​greymoth-jp)
• 종윤 (@​jyx-07)

v11.1.27

Compare Source

What's Changed

• fix(core): sse async handlers teardown issue by @​kamilmysliwiec in #​17131
• fix(platform-fastify): forRoutes middleware ending slash by @​kamilmysliwiec in #​17138

Full Changelog: nestjs/nest@v11.1.26...v11.1.27

v11.1.26

Compare Source

What's Changed

• fix(core): post sse endpoint empty response #​17098 by @​kamilmysliwiec in #​17099

Full Changelog: nestjs/nest@v11.1.25...v11.1.26

v11.1.25

Compare Source

What's Changed

• fix(microservices): reject pending Redis requests on close by @​yudin-s in #​17024
• fix(core): register SSE close listener before async setup by @​fallintoplace in #​17018
• fix(platform-fastify): remove pathname ending slash by @​kamilmysliwiec in #​17094

New Contributors

• @​fallintoplace made their first contribution in #​17018
• @​DucMinhNe made their first contribution in #​17085
• @​iambeaukim made their first contribution in #​17091

Full Changelog: nestjs/nest@v11.1.24...v11.1.25

v11.1.24

Compare Source

v11.1.24 (2026-05-25)

Bug fixes

• core
  • #​17009 fix(core): reset dependency-tree cache on metadata changes (@​puneetdixit200)

Enhancements

• core
  • #​16997 feat(core): warn on late websocket adapter registration (@​hbinhng)

Dependencies

• platform-ws
  • #​17011 chore(deps): bump ws from 8.20.1 to 8.21.0 (@​dependabot[bot])

Committers: 2

• Nguyễn Hải Bình (@​hbinhng)
• Puneet Dixit (@​puneetdixit200)

v11.1.23

Compare Source

v11.1.23 (2026-05-21)

Bug fixes

• core
  • #​16998 fix snapshot: true eagerly instantiates Terminus transient indicators since 11.1.20

Committers: 1

• Kamil Mysliwiec (@​kamilmysliwiec)

v11.1.22

Compare Source

v11.1.22 (2026-05-21)

Bug fixes

• core
  • #​16993 fix(core): inflight request injection bug #​16989 (@​kamilmysliwiec)

Enhancements

• core
  • #​16967 fix(core): identify decorator type in invalid-class-module error (@​HarrierOnChain)

Committers: 2

• Harrier (@​HarrierOnChain)
• Kamil Mysliwiec (@​kamilmysliwiec)

v11.1.21

Compare Source

v11.1.21 (2026-05-14)

Bug fixes

• core
  • #​16948 fix(core): settle skipped provider initialization (@​yudin-s)

Committers: 1

• Serge Yudin (@​yudin-s)

v11.1.20

Compare Source

v11.1.20 (2026-05-13)

Bug fixes

• core, testing
  • #​16939 fix(core): fix deeply nested transient providers resolution (@​kamilmysliwiec)
• core
  • #​16861 fix(core): fix @​Sse losing events on complete (@​MatthiasBrehmer)
  • #​16753 fix(core): defer sse writehead until after lifecycle completes (@​jkalberer)
  • #​16782 fix(core): use strict null check for SSE message id (@​burhanharoon)
• microservices
  • #​16850 fix(microservices): ServerRMQ crashes at boot when @​MessagePattern(undefined) is combined with wildcards: true (@​lavieennoir)
• common
  • #​16845 fix(common): accept zero timestamp in parse date pipe (@​Mysh3ll)
• platform-socket.io
  • #​16742 fix(socket.io): Deduplicate disconnect listener in bindMessageHandlers (@​fru1tworld)

Enhancements

• microservices
  • #​16676 feat(microservices): add return buffers option for binary data (@​Forceres)
  • #​16826 feat(microservices): handle rmq blocked/unblocked connection events (@​thisalihassan)
• common
  • #​16902 fix(common): filetype validator buffer message (@​QusaiAlbonni)
• platform-express
  • #​16844 feat(platform-express): add defParamCharset to MulterOptions (@​starnayuta)

Dependencies

• platform-ws
  • #​16941 chore(deps): bump ws from 8.20.0 to 8.20.1 (@​dependabot[bot])

Committers: 13

• Ali Hassan (@​thisalihassan)
• Burhan Haroon⚡ (@​burhanharoon)
• Dmytro Khyzhniak (@​lavieennoir)
• Harsh Rathod (@​harshrathod50)
• IlyaCredo (@​Forceres)
• Kamil Mysliwiec (@​kamilmysliwiec)
• Mysh3ll (@​Mysh3ll)
• @​MatthiasBrehmer
• @​QusaiAlbonni
• @​jkalberer
• @​pazaderey
• fru1tworld (@​fru1tworld)
• starnayuta (@​starnayuta)

v11.1.19

Compare Source

v11.1.19 (2026-04-13)

Bug fixes

• microservices
  • #​16762 fix(microservices): use backing field for consumer CRASH event listener (@​burhanharoon)
  • #​16764 fix(microservices): prevent stack overflow in jsonsocket.handledata() (@​kamilmysliwiec)

Committers: 2

• Burhan Haroon⚡ (@​burhanharoon)
• Kamil Mysliwiec (@​kamilmysliwiec)

v11.1.18

Compare Source

v11.1.18 (2026-04-03)

Bug fixes

• microservices
  • #​16675 fix(microservices): preserve packet headers in nats serializer (@​wwenrr)
• core
  • #​16683 fix(core): prevent injector hang when design:paramtypes is missing (@​Youmoo)
  • #​16637 fix(core): dependency injection edge case with moduleref.create (@​JakobStaudinger)
  • #​16686 fix(core): sanitize sse message

Dependencies

• core, platform-express, platform-fastify
  • #​16679 fix(deps): update dependency path-to-regexp to v8.4.2 (@​renovate[bot])
• platform-fastify
  • #​16623 fix(deps): update dependency fastify to v5.8.4 (@​renovate[bot])
• platform-ws
  • #​16618 chore(deps): bump ws from 8.19.0 to 8.20.0 (@​dependabot[bot])
• common
  • #​16619 chore(deps): bump file-type from 21.3.3 to 21.3.4 (@​dependabot[bot])

Committers: 6

• Ankit San (@​ankitbelal)
• Jakob Staudinger (@​JakobStaudinger)
• Kamil Mysliwiec (@​kamilmysliwiec)
• Krishna Chaitanya (@​Krishnachaitanyakc)
• MK (@​wwenrr)
• youmoo (@​Youmoo)

v11.1.17

Compare Source

v11.1.17 (2026-03-16)

Enhancements

• microservices
  • #​16218 feat(microservices): add redis driver identification (@​vchomakov)

Bugs

• platform-fastify
  • auto-run middleware for HEAD requests as fastify redirects them to GET handlers (effectively skipping middleware execution) cbdf737 (@​kamilmysliwiec)

Dependencies

• common
  • #​16567 fix(deps): update dependency file-type to v21.3.2 (@​renovate[bot])
• platform-fastify
  • #​16533 fix(deps): update dependency fastify to v5.8.2 (@​renovate[bot])

Committers: 3

• Rohan Santhosh Kumar (@​Rohan5commit)
• Vasil Chomakov (@​vchomakov)
• Kamil Mysliwiec (@​kamilmysliwiec)

v11.1.16

Compare Source

v11.1.16 (2026-03-05)

Bug fixes

• microservices
  • #​16506 fix(microservices): fix double callback when isdisposed or err is truthy (@​LhonRafaat)

Dependencies

• platform-express
  • #​16507 fix(deps): update dependency multer to v2.1.1 (@​renovate[bot])

Committers: 2

• Lhon (@​LhonRafaat)
• Shahnoor Mujawar (@​shahnoormujawar)

v11.1.15

Compare Source

What's Changed

• fix(microservices): if indexOf return 0 will if will be falsy by @​cuiweixie in #​16401
• fix(microservices): introuduce max pattern depth and object complexity by @​kamilmysliwiec in #​16402
• chore(@​nestjs/core): allow override for initializeWildcardHandlersIfE… by @​StNekroman in #​16468
• chore(deps): update dependency @​fastify/middie to v9.2.0 [security] by @​renovate[bot] in #​16472
• fix(deps): update dependency multer to v2.1.0 [security] by @​renovate[bot] in #​16474

New Contributors

• @​cuiweixie made their first contribution in #​16401
• @​StNekroman made their first contribution in #​16468

Full Changelog: nestjs/nest@v11.1.14...v11.1.15

v11.1.14

Compare Source

v11.1.14 (2026-02-17)

Bug fixes

• platform-fastify
  • #​16384 fix(fastify): fastify middleware bypass cve (@​kamilmysliwiec)
• common
  • #​16307 fix: logger print invalid context when no stack trace provided (@​JulienDuf)

Enhancements

• common
  • #​16314 fix(common): change requestOrigin type (@​SpencerKaiser)

Committers: 5

• Julien Dufresne (@​JulienDuf)
• Kamil Mysliwiec (@​kamilmysliwiec)
• Mykhailo Skrypsky (@​mixator)
• Spencer Kaiser (@​SpencerKaiser)
• 조수민 (@​suuuuuuminnnnnn)

v11.1.13

Compare Source

v11.1.13 (2026-02-03)

Bug fixes

• common
  • #​16230 fix(common): Fix skipping maxArrayLength and maxStringLength option (@​chojs23)

Enhancements

• microservices
  • #​16286 feat(microservices): support per-handler qos in mqtt (@​suuuuuuminnnnnn)
  • #​16262 Feat/microservices configurable max buffer size (@​jobnow)
• common
  • #​16202 fix(common): exclude built-in primitives from strip proto keys (@​som14062005)

Dependencies

• platform-fastify
  • #​16282 fix(deps): update dependency fastify to v5.7.4 (@​renovate[bot])
• platform-express
  • #​16241 fix(deps): update dependency cors to v2.8.6 (@​renovate[bot])

Committers: 6

• Lee Donghyun (@​devizi0)
• Mykhailo Skrypsky (@​mixator)
• Neo (@​chojs23)
• Praveen Somasundaram (@​som14062005)
• Ricardo Gomes (@​jobnow)
• 조수민 (@​suuuuuuminnnnnn)

v11.1.12

Compare Source

v11.1.12 (2026-01-15)

Bug fixes

• common
  • #​16187 fix(common): regression in loading file-type under Windows OS (@​iamkanguk97)

Dependencies

• platform-ws
  • #​16161 chore(deps): bump ws from 8.18.3 to 8.19.0 (@​dependabot[bot])
• common
  • #​16155 fix(deps): update dependency file-type to v21.3.0 (@​renovate[bot])
• platform-fastify
  • #​16154 fix(deps): update dependency find-my-way to v9.4.0 (@​renovate[bot])

Committers: 3

• Antonio Tripodi (@​Tony133)
• KANGUK LEE (@​iamkanguk97)
• @​miso-kyoungminkim

v11.1.11

Compare Source

v11.1.11 (2025-12-29)

Bug fixes

• platform-fastify
  • #​16135 fix(platform-fastify): middie bypassing through decoded chars (@​kamilmysliwiec)
• core
  • #​16133 fix(core): add missing catch handler for forward-ref provider resolution (@​coti-z)

Dependencies

• platform-socket.io
  • #​16125 fix(deps): update dependency socket.io to v4.8.3 (@​renovate[bot])
  • #​16114 chore(deps): bump socket.io from 4.8.1 to 4.8.2 (@​dependabot[bot])
• platform-fastify
  • #​16130 fix(deps): update dependency @​fastify/static to v9 (@​renovate[bot])
• common
  • #​16127 chore(deps): bump file-type from 21.1.1 to 21.2.0 (@​dependabot[bot])

Committers: 3

• Himanshu Gupta (@​manureja64)
• Kamil Mysliwiec (@​kamilmysliwiec)
• coti (@​coti-z)

v11.1.10

Compare Source

v11.1.10 (2025-12-22)

Bug fixes

• core
  • #​16098 fix(core): instantiate nested transient providers in static context (@​mag123c)
  • #​16005 fix(core): resolve all providers when using resolve() with each option (@​malkovitc)
• microservices
  • #​16072 fix(microservices): fix grpc stream method return type (@​shash-hq)
• common
  • #​16077 fix(common): resolve file-type path explicitly (@​shash-hq)
  • #​16013 fix(common): Support fallbackToMimetype without buffer (@​chenjieya)

Enhancements

• common
  • #​16100 fix(common): improve error handling in FileTypeValidator (@​malkovitc)
  • #​16060 feat(common): add message property to file type validator (@​Jo-Minseok)
  • #​16079 fix: enhance ValidationPipe (@​liu-jin-yi)
• core
  • #​15721 feat(core): add Promise support for SSE handlers (@​pythonjsgo)
• microservices
  • #​15975 feat(microservices): add keepalive support for server side (@​OlegStrokan)
• common, core
  • #​15986 feat(core): add option for async logger compatibility (@​mag123c)

Dependencies

• platform-fastify
  • #​16041 fix(deps): update dependency @​fastify/cors to v11.2.0 (@​renovate[bot])
• platform-express
  • #​16002 fix(deps): update dependency express to v5.2.1 (@​renovate[bot])
• common
  • #​15948 chore(deps): bump file-type from 21.1.0 to 21.1.1 (@​dependabot[bot])

Committers: 11

• Alexander (@​pythonjsgo)
• J_Coder (@​Jo-Minseok)
• Luke Son (@​KAPUIST)
• Oleh Strokan (@​OlegStrokan)
• Praveen Somasundaram (@​som14062005)
• Shashank (@​shash-hq)
• @​chenjieya
• @​giorgikakauridze
• @​mag123c
• chernomortsev evgeny (@​malkovitc)
• liu-jin-yi (@​liu-jin-yi)

v11.1.9

Compare Source

v11.1.9 (2025-11-14)

Bug fixes

• core
  • #​15865 fix(core): make get() throw for implicitly request-scoped trees (@​JoeNutt)

Enhancements

• common
  • #​15863 feat(common): add method options to @​sse decorator (@​TomerSteinberg)

Dependencies

• platform-fastify
  • #​15899 chore(deps): bump fastify from 5.6.1 to 5.6.2 (@​dependabot[bot])

Committers: 4

• Rami (@​JoeNutt)
• Rhynel Algopera (@​dev-rhynel)
• Tomer Steinberg (@​TomerSteinberg)
• WuMingDao (@​WuMingDao)

v11.1.8

Compare Source

v11.1.8 (2025-10-27)

Bug fixes

• core
  • #​15815 fix(core): ensure nested transient provider isolation (@​mag123c)
• platform-fastify
  • #​15831 fix(fastify): Migrate fastify top-level options to routerOptions ([@​

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.