fix(deps): update dependency @nestjs/platform-fastify to v11 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@nestjs/platform-fastify (source)	10.4.20 → 11.1.24

---

Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)

CVE-2025-69211 / GHSA-8wpr-639p-ccrj

More information

Details

A NestJS application is vulnerable if it meets all of the following criteria:

1. Platform: Uses @nestjs/platform-fastify.
2. Security Mechanism: Relies on NestMiddleware (via MiddlewareConsumer) for security checks (authentication, authorization, etc.), or through app.use()
3. Routing: Applies middleware to specific routes using string paths or controllers (e.g., .forRoutes('admin')).
   Example Vulnerable Config:

// app.module.ts
export class AppModule implements NestModule {
  configure(consumer: MiddlewareConsumer) {
    consumer
      .apply(AuthMiddleware) // Security check
      .forRoutes('admin');   // Vulnerable: Path-based restriction
  }
}

Attack Vector:

• Target Route: /admin
• Middleware Path: admin
• Attack Request: GET /%61dmin
• Result: Middleware is skipped (no match on %61dmin), but controller for /admin is executed.

Consequences:

• Authentication Bypass: Unauthenticated users can access protected routes.
• Authorization Bypass: Restricted administrative endpoints become accessible to lower-privileged users.
• Input Validation Bypass: Middleware performing sanitization or validation can be skipped.

Patches

Patched in @nestjs/platform-fastify@11.1.11

Resources

Credit goes to Hacktron AI for reporting this issue.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

References

• https://github.com/nestjs/nest/security/advisories/GHSA-8wpr-639p-ccrj
• https://nvd.nist.gov/vuln/detail/CVE-2025-69211
• https://github.com/nestjs/nest/commit/c4cedda15a05aafec1e6045b36b0335ab850e771
• https://github.com/advisories/GHSA-8wpr-639p-ccrj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Nest has a Fastify URL Encoding Middleware Bypass

CVE-2026-2293 / GHSA-r4wm-x892-vjmx

More information

Details

Impact

What kind of vulnerability is it? Who is impacted?

A NestJS application using @nestjs/platform-fastify can allow bypass of any middleware when Fastify path-normalization options (e.g., ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter) are enabled. In affected route-scoped middleware setups, variant paths may skip middleware checks while still reaching the protected handler.

The bug is a path canonicalization mismatch between middleware matching and route matching in Nest’s Fastify adapter.

Nest passes Fastify routerOptions (such as ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter) to the Fastify router in packages/platform-fastify/adapters/fastify-adapter.ts:253.

But middleware execution is decided by a separate regex check over req.originalUrl in packages/platform-fastify/adapters/fastify-adapter.ts:706 and packages/platform-fastify/adapters/fastify-adapter.ts:713.

If that regex does not match, Nest does next() and skips the middleware (packages/platform-fastify/adapters/fastify-adapter.ts:714), while Fastify may still normalize the same path and route it to the protected handler. So the vulnerability exists because security checks (middleware) and request dispatch(router) use different URL interpretations.

This is a fail-open design issue (inconsistent normalization), not just a bad app config: non-default router options make the mismatch reachable.

Patches

Fixed in @nestjs/platform-fastify@11.1.14

References

Credit goes to Fluidattacks (Cristian Vargas) https://fluidattacks.com/advisories/neton

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/nestjs/nest/security/advisories/GHSA-r4wm-x892-vjmx
• https://nvd.nist.gov/vuln/detail/CVE-2026-2293
• https://github.com/nestjs/nest/commit/fd8d073e0e048b185147209338ca7042e52c10ba
• https://fluidattacks.com/advisories/neton
• https://github.com/nestjs/nest/releases/tag/v11.1.14
• https://github.com/advisories/GHSA-r4wm-x892-vjmx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Nest Fastify HEAD Request Middleware Bypass

CVE-2026-33011 / GHSA-wf42-42fg-fg84

More information

Details

Impact

In a NestJS application using @nestjs/platform-fastify, GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers (if they exist).

As a result:

• Middleware will be completely skipped.
• The HTTP response won't include a body (since the response is truncated when redirecting a HEAD request to a GET handler).
• The actual handler will still be executed.

Patches

Fixed in @nestjs/platform-fastify@11.1.16

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/nestjs/nest/security/advisories/GHSA-wf42-42fg-fg84
• https://github.com/nestjs/nest/commit/cbdf737cd6e7cefa52d05ecea2ae4af95c464614
• https://github.com/nestjs/nest/releases/tag/v11.1.17
• https://nvd.nist.gov/vuln/detail/CVE-2026-33011
• https://github.com/advisories/GHSA-wf42-42fg-fg84

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Nest: Middleware Bypass on Fastify via Trailing Slash

CVE-2026-54281 / GHSA-6v32-fjc9-9qf6

More information

Details

Impact

An authentication bypass vulnerability exists in @nestjs/platform-fastify (confirmed on version 11.1.24, the latest available release at time of report). When middleware is registered through NestJS's MiddlewareConsumer.forRoutes() API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (/) to the request URL.

This bypass works on the default Fastify adapter configuration — no special router options need to be enabled. Applications using the standard CRUD route shape (GET /resource and GET /resource/:id) are affected when they protect those routes with MiddlewareConsumer.forRoutes() middleware.

Patches

Fixed in @nestjs/platform-fastify@11.1.24

References

Kudos goes to @​a-tt-om

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/nestjs/nest/security/advisories/GHSA-6v32-fjc9-9qf6
• https://nvd.nist.gov/vuln/detail/CVE-2026-54281
• https://github.com/advisories/GHSA-6v32-fjc9-9qf6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

nestjs/nest (@​nestjs/platform-fastify)

v11.1.24

Compare Source

v11.1.24 (2026-05-25)

Bug fixes

• core
  • #​17009 fix(core): reset dependency-tree cache on metadata changes (@​puneetdixit200)

Enhancements

• core
  • #​16997 feat(core): warn on late websocket adapter registration (@​hbinhng)

Dependencies

• platform-ws
  • #​17011 chore(deps): bump ws from 8.20.1 to 8.21.0 (@​dependabot[bot])

Committers: 2

• Nguyễn Hải Bình (@​hbinhng)
• Puneet Dixit (@​puneetdixit200)

v11.1.23

Compare Source

v11.1.23 (2026-05-21)

Bug fixes

• core
  • #​16998 fix snapshot: true eagerly instantiates Terminus transient indicators since 11.1.20

Committers: 1

• Kamil Mysliwiec (@​kamilmysliwiec)

v11.1.22

Compare Source

v11.1.22 (2026-05-21)

Bug fixes

• core
  • #​16993 fix(core): inflight request injection bug #​16989 (@​kamilmysliwiec)

Enhancements

• core
  • #​16967 fix(core): identify decorator type in invalid-class-module error (@​HarrierOnChain)

Committers: 2

• Harrier (@​HarrierOnChain)
• Kamil Mysliwiec (@​kamilmysliwiec)

v11.1.21

Compare Source

v11.1.21 (2026-05-14)

Bug fixes

• core
  • #​16948 fix(core): settle skipped provider initialization (@​yudin-s)

Committers: 1

• Serge Yudin (@​yudin-s)

v11.1.20

Compare Source

v11.1.20 (2026-05-13)

Bug fixes

• core, testing
  • #​16939 fix(core): fix deeply nested transient providers resolution (@​kamilmysliwiec)
• core
  • #​16861 fix(core): fix @​Sse losing events on complete (@​MatthiasBrehmer)
  • #​16753 fix(core): defer sse writehead until after lifecycle completes (@​jkalberer)
  • #​16782 fix(core): use strict null check for SSE message id (@​burhanharoon)
• microservices
  • #​16850 fix(microservices): ServerRMQ crashes at boot when @​MessagePattern(undefined) is combined with wildcards: true (@​lavieennoir)
• common
  • #​16845 fix(common): accept zero timestamp in parse date pipe (@​Mysh3ll)
• platform-socket.io
  • #​16742 fix(socket.io): Deduplicate disconnect listener in bindMessageHandlers (@​fru1tworld)

Enhancements

• microservices
  • #​16676 feat(microservices): add return buffers option for binary data (@​Forceres)
  • #​16826 feat(microservices): handle rmq blocked/unblocked connection events (@​thisalihassan)
• common
  • #​16902 fix(common): filetype validator buffer message (@​QusaiAlbonni)
• platform-express
  • #​16844 feat(platform-express): add defParamCharset to MulterOptions (@​starnayuta)

Dependencies

• platform-ws
  • #​16941 chore(deps): bump ws from 8.20.0 to 8.20.1 (@​dependabot[bot])

Committers: 13

• Ali Hassan (@​thisalihassan)
• Burhan Haroon⚡ (@​burhanharoon)
• Dmytro Khyzhniak (@​lavieennoir)
• Harsh Rathod (@​harshrathod50)
• IlyaCredo (@​Forceres)
• Kamil Mysliwiec (@​kamilmysliwiec)
• Mysh3ll (@​Mysh3ll)
• @​MatthiasBrehmer
• @​QusaiAlbonni
• @​jkalberer
• @​pazaderey
• fru1tworld (@​fru1tworld)
• starnayuta (@​starnayuta)

v11.1.19

Compare Source

v11.1.19 (2026-04-13)

Bug fixes

• microservices
  • #​16762 fix(microservices): use backing field for consumer CRASH event listener (@​burhanharoon)
  • #​16764 fix(microservices): prevent stack overflow in jsonsocket.handledata() (@​kamilmysliwiec)

Committers: 2

• Burhan Haroon⚡ (@​burhanharoon)
• Kamil Mysliwiec (@​kamilmysliwiec)

v11.1.18

Compare Source

v11.1.18 (2026-04-03)

Bug fixes

• microservices
  • #​16675 fix(microservices): preserve packet headers in nats serializer (@​wwenrr)
• core
  • #​16683 fix(core): prevent injector hang when design:paramtypes is missing (@​Youmoo)
  • #​16637 fix(core): dependency injection edge case with moduleref.create (@​JakobStaudinger)
  • #​16686 fix(core): sanitize sse message

Dependencies

• core, platform-express, platform-fastify
  • #​16679 fix(deps): update dependency path-to-regexp to v8.4.2 (@​renovate[bot])
• platform-fastify
  • #​16623 fix(deps): update dependency fastify to v5.8.4 (@​renovate[bot])
• platform-ws
  • #​16618 chore(deps): bump ws from 8.19.0 to 8.20.0 (@​dependabot[bot])
• common
  • #​16619 chore(deps): bump file-type from 21.3.3 to 21.3.4 (@​dependabot[bot])

Committers: 6

• Ankit San (@​ankitbelal)
• Jakob Staudinger (@​JakobStaudinger)
• Kamil Mysliwiec (@​kamilmysliwiec)
• Krishna Chaitanya (@​Krishnachaitanyakc)
• MK (@​wwenrr)
• youmoo (@​Youmoo)

v11.1.17

Compare Source

v11.1.17 (2026-03-16)

Enhancements

• microservices
  • #​16218 feat(microservices): add redis driver identification (@​vchomakov)

Bugs

• platform-fastify
  • auto-run middleware for HEAD requests as fastify redirects them to GET handlers (effectively skipping middleware execution) cbdf737 (@​kamilmysliwiec)

Dependencies

• common
  • #​16567 fix(deps): update dependency file-type to v21.3.2 (@​renovate[bot])
• platform-fastify
  • #​16533 fix(deps): update dependency fastify to v5.8.2 (@​renovate[bot])

Committers: 3

• Rohan Santhosh Kumar (@​Rohan5commit)
• Vasil Chomakov (@​vchomakov)
• Kamil Mysliwiec (@​kamilmysliwiec)

v11.1.16

Compare Source

v11.1.16 (2026-03-05)

Bug fixes

• microservices
  • #​16506 fix(microservices): fix double callback when isdisposed or err is truthy (@​LhonRafaat)

Dependencies

• platform-express
  • #​16507 fix(deps): update dependency multer to v2.1.1 (@​renovate[bot])

Committers: 2

• Lhon (@​LhonRafaat)
• Shahnoor Mujawar (@​shahnoormujawar)

v11.1.15

Compare Source

What's Changed

• fix(microservices): if indexOf return 0 will if will be falsy by @​cuiweixie in #​16401
• fix(microservices): introuduce max pattern depth and object complexity by @​kamilmysliwiec in #​16402
• chore(@​nestjs/core): allow override for initializeWildcardHandlersIfE… by @​StNekroman in #​16468
• chore(deps): update dependency @​fastify/middie to v9.2.0 [security] by @​renovate[bot] in #​16472
• fix(deps): update dependency multer to v2.1.0 [security] by @​renovate[bot] in #​16474

New Contributors

• @​cuiweixie made their first contribution in #​16401
• @​StNekroman made their first contribution in #​16468

Full Changelog: nestjs/nest@v11.1.14...v11.1.15

v11.1.14

Compare Source

v11.1.14 (2026-02-17)

Bug fixes

• platform-fastify
  • #​16384 fix(fastify): fastify middleware bypass cve (@​kamilmysliwiec)
• common
  • #​16307 fix: logger print invalid context when no stack trace provided (@​JulienDuf)

Enhancements

• common
  • #​16314 fix(common): change requestOrigin type (@​SpencerKaiser)

Committers: 5

• Julien Dufresne (@​JulienDuf)
• Kamil Mysliwiec (@​kamilmysliwiec)
• Mykhailo Skrypsky (@​mixator)
• Spencer Kaiser (@​SpencerKaiser)
• 조수민 (@​suuuuuuminnnnnn)

v11.1.13

Compare Source

v11.1.13 (2026-02-03)

Bug fixes

• common
  • #​16230 fix(common): Fix skipping maxArrayLength and maxStringLength option (@​chojs23)

Enhancements

• microservices
  • #​16286 feat(microservices): support per-handler qos in mqtt (@​suuuuuuminnnnnn)
  • #​16262 Feat/microservices configurable max buffer size (@​jobnow)
• common
  • #​16202 fix(common): exclude built-in primitives from strip proto keys (@​som14062005)

Dependencies

• platform-fastify
  • #​16282 fix(deps): update dependency fastify to v5.7.4 (@​renovate[bot])
• platform-express
  • #​16241 fix(deps): update dependency cors to v2.8.6 (@​renovate[bot])

Committers: 6

• Lee Donghyun (@​devizi0)
• Mykhailo Skrypsky (@​mixator)
• Neo (@​chojs23)
• Praveen Somasundaram (@​som14062005)
• Ricardo Gomes (@​jobnow)
• 조수민 (@​suuuuuuminnnnnn)

v11.1.12

Compare Source

v11.1.12 (2026-01-15)

Bug fixes

• common
  • #​16187 fix(common): regression in loading file-type under Windows OS (@​iamkanguk97)

Dependencies

• platform-ws
  • #​16161 chore(deps): bump ws from 8.18.3 to 8.19.0 (@​dependabot[bot])
• common
  • #​16155 fix(deps): update dependency file-type to v21.3.0 (@​renovate[bot])
• platform-fastify
  • #​16154 fix(deps): update dependency find-my-way to v9.4.0 (@​renovate[bot])

Committers: 3

• Antonio Tripodi (@​Tony133)
• KANGUK LEE (@​iamkanguk97)
• @​miso-kyoungminkim

v11.1.11

Compare Source

v11.1.11 (2025-12-29)

Bug fixes

• platform-fastify
  • #​16135 fix(platform-fastify): middie bypassing through decoded chars (@​kamilmysliwiec)
• core
  • #​16133 fix(core): add missing catch handler for forward-ref provider resolution (@​coti-z)

Dependencies

• platform-socket.io
  • #​16125 fix(deps): update dependency socket.io to v4.8.3 (@​renovate[bot])
  • #​16114 chore(deps): bump socket.io from 4.8.1 to 4.8.2 (@​dependabot[bot])
• platform-fastify
  • #​16130 fix(deps): update dependency @​fastify/static to v9 (@​renovate[bot])
• common
  • #​16127 chore(deps): bump file-type from 21.1.1 to 21.2.0 (@​dependabot[bot])

Committers: 3

• Himanshu Gupta (@​manureja64)
• Kamil Mysliwiec (@​kamilmysliwiec)
• coti (@​coti-z)

v11.1.10

Compare Source

v11.1.10 (2025-12-22)

Bug fixes

• core
  • #​16098 fix(core): instantiate nested transient providers in static context (@​mag123c)
  • #​16005 fix(core): resolve all providers when using resolve() with each option (@​malkovitc)
• microservices
  • #​16072 fix(microservices): fix grpc stream method return type (@​shash-hq)
• common
  • #​16077 fix(common): resolve file-type path explicitly (@​shash-hq)
  • #​16013 fix(common): Support fallbackToMimetype without buffer (@​chenjieya)

Enhancements

• common
  • #​16100 fix(common): improve error handling in FileTypeValidator (@​malkovitc)
  • #​16060 feat(common): add message property to file type validator (@​Jo-Minseok)
  • #​16079 fix: enhance ValidationPipe (@​liu-jin-yi)
• core
  • #​15721 feat(core): add Promise support for SSE handlers (@​pythonjsgo)
• microservices
  • #​15975 feat(microservices): add keepalive support for server side (@​OlegStrokan)
• common, core
  • #​15986 feat(core): add option for async logger compatibility (@​mag123c)

Dependencies

• platform-fastify
  • #​16041 fix(deps): update dependency @​fastify/cors to v11.2.0 (@​renovate[bot])
• platform-express
  • #​16002 fix(deps): update dependency express to v5.2.1 (@​renovate[bot])
• common
  • #​15948 chore(deps): bump file-type from 21.1.0 to 21.1.1 (@​dependabot[bot])

Committers: 11

• Alexander (@​pythonjsgo)
• J_Coder (@​Jo-Minseok)
• Luke Son (@​KAPUIST)
• Oleh Strokan (@​OlegStrokan)
• Praveen Somasundaram (@​som14062005)
• Shashank (@​shash-hq)
• @​chenjieya
• @​giorgikakauridze
• @​mag123c
• chernomortsev evgeny (@​malkovitc)
• liu-jin-yi (@​liu-jin-yi)

v11.1.9

Compare Source

v11.1.9 (2025-11-14)

Bug fixes

• core
  • #​15865 fix(core): make get() throw for implicitly request-scoped trees (@​JoeNutt)

Enhancements

• common
  • #​15863 feat(common): add method options to @​sse decorator (@​TomerSteinberg)

Dependencies

• platform-fastify
  • #​15899 chore(deps): bump fastify from 5.6.1 to 5.6.2 (@​dependabot[bot])

Committers: 4

• Rami (@​JoeNutt)
• Rhynel Algopera (@​dev-rhynel)
• Tomer Steinberg (@​TomerSteinberg)
• WuMingDao (@​WuMingDao)

v11.1.8

Compare Source

v11.1.8 (2025-10-27)

Bug fixes

• core
  • #​15815 fix(core): ensure nested transient provider isolation (@​mag123c)
• platform-fastify
  • #​15831 fix(fastify): Migrate fastify top-level options to routerOptions (@​kim-sung-jee)

Committers: 2

• JaeHo Jang (@​mag123c)
• Seongjee Kim (@​kim-sung-jee)

v11.1.7

Compare Source

v11.1.7 (2025-10-21)

Bug fixes

• microservices
  • #​15747 Fix/rmq microservice fanout bind (@​slon2015)
• platform-fastify
  • #​15732 fix: correct parameter type in RouteConstraints decorator (@​thedv91)
• core
  • #​15571 fix(core): skip lifecycle hooks for non-instantiated transient services (@​mag123c)
• common
  • #​15577 Add color allowance check to console logger options (@​kerryChen95)

Enhancements

• common, platform-socket.io, websockets
  • #​15543 feat(websockets): allow manual acknowledgement handling with @​Ack() decorator (@​kim-sung-jee)
• common
  • #​15705 fix(core): resolve extras in configurable module builder async methods (@​mag123c)
• common, core
  • #​15503 feat(common): add force-console option to console logger (@​mag123c)
• core
  • #​15588 fix(core): improve dependency resolution error messages (@​at7211)
• microservices
  • #​15598 feat(errors): add InvalidTcpDataReceptionException for handling TCP receive errors​ (@​ghyghoo8)

Dependencies

• platform-fastify
  • #​15664 chore(deps): bump fastify to 5.6.1 (@​dependabot[bot])
• core, platform-express, platform-fastify
  • #​15622 fix(deps): update dependency path-to-regexp to v8.3.0 (@​renovate[bot])
• common
  • #​15566 chore(deps): bump load-esm from 1.0.2 to 1.0.3 (@​dependabot[bot])

Committers: 9

• Harry (@​thedv91)
• JaeHo Jang (@​mag123c)
• Jay-Chou (@​at7211)
• Kerry (@​kerryChen95)
• Micael Levi L. Cavalcante (@​micalevisk)
• Seongjee Kim (@​kim-sung-jee)
• SerafimGerasimov (@​slon2015)
• @​Olexandr88
• ghy (@​ghyghoo8)

v11.1.6

Compare Source

v11.1.6 (2025-08-07)

Bug fixes

• core
  • #​15504 fix(core): fix race condition in class dependency resolution from imported modules (@​hajekjiri)
  • #​15469 fix(core): attach root inquirer for nested transient providers (@​kamilmysliwiec)
• microservices
  • #​15508 fix(microservices): report correct buffer length in exception (@​kim-sung-jee)
  • #​15492 fix(microservices): fix kafka serilization of class instances (@​LeonBiersch)

Dependencies

• platform-fastify
  • #​15493 chore(deps): bump @​fastify/cors from 11.0.1 to 11.1.0 (@​dependabot[bot])

Committers: 6

• Jiri Hajek (@​hajekjiri)
• Kamil Mysliwiec (@​kamilmysliwiec)
• Leon Biersch (@​LeonBiersch)
• Seongjee Kim (@​kim-sung-jee)
• @​premierbell
• pTr (@​ptrgits)

v11.1.5

Compare Source

v11.1.5 (2025-07-18)

Dependencies

• platform-express
  • #​15425 chore(deps): bump multer from 2.0.1 to 2.0.2 in /packages/platform-express (@​dependabot[bot])

v11.1.4

Compare Source

v11.1.4 (2025-07-16)

Bug fixes

• platform-fastify
  • #​15385 fix(testing): auto-init fastify adapter for middleware registration (@​mag123c)
• core, testing
  • #​15405 fix(core): fix race condition in class dependency resolution (@​hajekjiri)
• core
  • #​15333 fix(core): Make flattenRoutePath return a valid module (@​gentunian)
• microservices
  • #​15305 fix(microservices): Revisit RMQ pattern matching with wildcards (@​getlarge)
  • #​15250 fix(constants): update RMQ_DEFAULT_QUEUE to an empty string (@​EeeasyCode)

Enhancements

• platform-fastify
  • #​14789 feat(fastify): add decorator for custom schema (@​piotrfrankowski)
• common, core, microservices, platform-express, platform-fastify, websockets
  • #​15386 feat: enhance introspection capabilities (@​kamilmysliwiec)
• core
  • #​15374 feat: supporting fine async storage control (@​Farenheith)

Dependencies

• platform-ws
  • #​15350 chore(deps): bump ws from 8.18.2 to 8.18.3 (@​dependabot[bot])
• platform-fastify
  • #​15278 chore(deps): bump fastify from 5.3.3 to 5.4.0 (@​dependabot[bot])

Committers: 11

• Alexey Filippov (@​SocketSomeone)
• EFIcats (@​ext4cats)
• Edouard Maleix (@​getlarge)
• JaeHo Jang (@​mag123c)
• Jiri Hajek (@​hajekjiri)
• Kamil Mysliwiec (@​kamilmysliwiec)
• Khan / 이창민 (@​EeeasyCode)
• Peter F. (@​piotrfrankowski)
• Sebastian (@​gentunian)
• Thiago Oliveira Santos (@​Farenheith)
• jochong (@​jochongs)

v11.1.3

Compare Source

v11.1.3 (2025-06-06)

Bug fixes

• core
  • #​15201 fix(core): gracefully shutdown the app when repl exits (@​dzhlobo)

Enhancements

• common
  • #​15209 feat: add string array type to disposition (@​fjodor-rybakov)
• common, core
  • #​15203 feat(core): defer initialization connected microservice (@​isaryy)

Dependencies

• platform-express
  • #​15232 chore(deps): bump multer from 2.0.0 to 2.0.1 (@​dependabot[bot])

Committers: 3

• Dmitry Zhlobo (@​dzhlobo)
• @​fjodor-rybakov
• @​isaryy

v11.1.2

Compare Source

v11.1.2 (2025-05-26)

Bug fixes

• microservices
  • #​15172 fix(microservices): support custom strategy in async usefactory config (@​mag123c)
  • #​15166 fix(microservice): prevent error logs during redis client shutdown (@​janroker)

Dependencies

• common
  • #​15185 chore(deps): bump file-type from 20.5.0 to 21.0.0 (@​dependabot[bot])
• platform-express
  • #​15159 chore(deps): bump multer from 1.4.5-lts.2 to 2.0.0 (@​dependabot[bot])

Committers: 2

• JaeHo Jang (@​mag123c)
• Jan Roček (@​janroker)

v11.1.1

Compare Source

v11.1.1 (2025-05-14)

Bug fixes

• core
  • #​15056 fix(core): HTTP adapter error mapping (@​maxbronnikov10)
• microservices
  • #​15062 fix(microservices): ensure all redis and amqp client closes properly (@​yatin166)
  • #​15032 fix(microservices): ensure all the amqp connections are closed properly (@​yatin166)
  • #​15020 fix(microservices): ensure all redis connections are closed (@​yatin166)
• core, platform-fastify
  • #​15061 fix(core): bring back getHeader and appendHeader methods from AbstractHttpAdapter (@​micalevisk)
• platform-express
  • #​15010 feat: remove use of pipeline (@​jmcdo29)

Enhancements

• microservices
  • #​14606 feat(microservices): add specific transport id to microservices (@​maxbronnikov10)
  • #​15057 feat(microservices): Allow custom exchangeType as string for plugin compatibility (@​ChangmoKang)
  • #​15072 feat(microservices): Add exchange arguments to RabbitMQ (@​gapon2401)

Dependencies

• platform-fastify
  • #​15129 chore(deps): bump fastify from 5.3.2 to 5.3.3 (@​dependabot[bot])
• platform-ws
  • #​15068 chore(deps): bump ws from 8.18.1 to 8.18.2 (@​dependabot[bot])
• common
  • #​15029 chore(deps): bump file-type from 20.4.1 to 20.5.0 (@​dependabot[bot])

Committers: 7

• Antonio Tripodi (@​Tony133)
• Changmo Kang (Ryan) (@​ChangmoKang)
• Igor Gaponov (@​gapon2401)
• Jackie McDoniel (@​jmcdo29)
• Maxim Bronnikov (@​maxbronnikov10)
• Micael Levi L. Cavalcante (@​micalevisk)
• Yatin Gaikwad (@​yatin166)

v11.1.0

Compare Source

v11.1.0 (2025-04-23)

Enhancements

• microservices
  • #​14540 feat(microservices): add support for topic exchange (rabbitmq) (@​kamilmysliwiec)

Committers: 1

• Kamil Mysliwiec (@​kamilmysliwiec)

v11.0.21

Compare Source

v11.0.21 (2025-04-23)

Enhancements

• common
  • #​14995 feat(common): Add fallbackToMimetype support in FileTypeValidator (@​mag123c)

Dependencies

• platform-fastify
  • #​14989 fix(deps): update dependency fastify to v5.3.2 [security] (@​renovate[bot])

Committers: 1

• JaeHo Jang (@​mag123c)

v11.0.20

Compare Source

What's Changed

• refactor(common): Prevent JavaScript being wrapped in eval by @​Borewit in #​14974

New Contributors

• @​Borewit made their first contribution in #​14974

Full Changelog: nestjs/nest@v11.0.19...v11.0.20

v11.0.19

Compare Source

v11.0.18

Compare Source

What's Changed

• chore(common): temporarily move file-type to regular deps d9a69a3

Full Changelog: nestjs/nest@v11.0.17...v11.0.18

v11.0.17

Compare Source

v11.0.16

Compare Source

v11.0.16 (2025-04-11)

• fix(common): use file-type to validate file mimetypes by @​Chathula in #​14881

v11.0.15

Compare Source

v11.0.15 (2025-04-10)

Bug fixes

• platform-fastify
  • #​14935 fix(fastify): methods comparison (@​johaven)

Committers: 1

• Johan Legrand (@​johaven)

v11.0.14

Compare Source

v11.0.14 (2025-04-09)

Bug fixes

• platform-fastify
  • #​14511 fix(fastify): adds the non-standard http methods to the instance (@​johaven)

Committers: 1

• Johan Legrand (@​johaven)

v11.0.13

Compare Source

v11.0.13 (2025-04-03)

Bug fixes

• platform-fastify
  • #​14895 fix(fastify-adapter): global prefix exclusion path handling w/middleware (@​KyleLilly)
• microservices
  • #​14869 fix(microservices): do not re-create client connection once get client by service name (@​mingo023)

Dependencies

• platform-express
  • #​14883 fix(deps): update dependency express to v5.1.0 (@​renovate[bot])
  • #​14817 fix(deps): update dependency multer to v1.4.5-lts.2 (@​renovate[bot])
• platform-fastify
  • #​14861 fix(deps): update dependency fastify to v5.2.2 (@​renovate[bot])
  • #​14864 chore(deps): bump @​fastify/cors from 11.0.0 to 11.0.1 (@​dependabot[bot])

Committers: 2

• Kyle Lilly ([@​KyleLilly](https://redi

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.