# What changed in @nestjs/microservices

> 18 changes in @nestjs/microservices 11 to 12 from its official release notes, upgrade guides and advisories: 5 breaking, 9 security, 4 new APIs and options. Each one cited. Sources checked 2026-11-01. HTML: https://unstale.sh/npm/@nestjs/microservices/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @nestjs/microservices 12

### Breaking changes

- NATS v3 dropped the JSONCodec helper, so applications using it must update their NATS code. (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)
- Custom NATS deserializers now receive the full NATS message object instead of a raw Uint8Array; read the payload with msg.json(). (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)
- The NATS transport now targets NATS v3; replace the old nats package with @nats-io/transport-node. (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)
- Nest now serializes NATS packets as JSON strings, affecting applications that depend on the previous serialization format. (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)
- NATS v3 dropped the StringCodec helper, so applications using it must update their NATS code. (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)

### Security

- Nest: Unbounded memory growth in the NestJS TCP microservice transport (11.2.5, 12.0.3) — [security advisory](https://github.com/advisories/GHSA-96H4-VGXJ-GVM2)
- Nest: Remote process termination via a deeply nested microservice message pattern (11.2.4, 12.0.2) — [security advisory](https://github.com/advisories/GHSA-M8VH-JMQ9-5RJG)
- @nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets (11.2.4, 12.0.2) — [security advisory](https://github.com/advisories/GHSA-9C5C-9QCX-Q35Q)

### New APIs and options

- The Kafka transport now accepts a RegExp for @EventPattern(), enabling regular-expression patterns. (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)
- GrpcExceptionFilter and status-specific exceptions map errors to the proper gRPC status codes instead of UNKNOWN. (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)
- The Kafka transport now accepts a RegExp for @MessagePattern(), enabling regular-expression patterns. (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)
- A new hook runs before a microservice message handler is invoked. (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)

## @nestjs/microservices 11

### Security

- Nest: Middleware Bypass on Fastify via Trailing Slash (11.1.24) — [security advisory](https://github.com/advisories/GHSA-6V32-FJC9-9QF6)
- Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport) (11.1.19) — [security advisory](https://github.com/advisories/GHSA-HPWF-8G29-85QM)
- @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection') (11.1.18) — [security advisory](https://github.com/advisories/GHSA-36XV-JGW5-4Q75)
- Nest Fastify HEAD Request Middleware Bypass (11.1.16) — [security advisory](https://github.com/advisories/GHSA-WF42-42FG-FG84)
- Nest has a Fastify URL Encoding Middleware Bypass (11.1.14) — [security advisory](https://github.com/advisories/GHSA-R4WM-X892-VJMX)
- Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU) (11.1.11) — [security advisory](https://github.com/advisories/GHSA-8WPR-639P-CCRJ)