npm / @nestjs/microservices

@nestjs/microservices

What changed in @nestjs/microservices 11 to 12, from its official release notes, upgrade guides and advisories. Sources checked 2026-11-01.

5 breaking9 security4 new APIs and options

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@nestjs/microservices 1212 changes

NATS v3 dropped the JSONCodec helper, so applications using it must update their NATS code.
12.0.0upgrade guide
Custom NATS deserializers now receive the full NATS message object instead of a raw Uint8Array; read the payload with msg.json().
12.0.0upgrade guide
The NATS transport now targets NATS v3; replace the old nats package with @nats-io/transport-node.
12.0.0upgrade guide
Nest now serializes NATS packets as JSON strings, affecting applications that depend on the previous serialization format.
12.0.0upgrade guide
NATS v3 dropped the StringCodec helper, so applications using it must update their NATS code.
12.0.0upgrade guide

Nest: Unbounded memory growth in the NestJS TCP microservice transport
11.2.5, 12.0.3security advisory
Nest: Remote process termination via a deeply nested microservice message pattern
11.2.4, 12.0.2security advisory
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
11.2.4, 12.0.2security advisory

The Kafka transport now accepts a RegExp for @EventPattern(), enabling regular-expression patterns.
12.0.0upgrade guide
GrpcExceptionFilter and status-specific exceptions map errors to the proper gRPC status codes instead of UNKNOWN.
12.0.0upgrade guide
The Kafka transport now accepts a RegExp for @MessagePattern(), enabling regular-expression patterns.
12.0.0upgrade guide
A new hook runs before a microservice message handler is invoked.
12.0.0upgrade guide

Nest: Middleware Bypass on Fastify via Trailing Slash
11.1.24security advisory
Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)
11.1.19security advisory
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
11.1.18security advisory
Nest Fastify HEAD Request Middleware Bypass
11.1.16security advisory
Nest has a Fastify URL Encoding Middleware Bypass
11.1.14security advisory
Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)
11.1.11security advisory