npm / @nestjs/platform-express

@nestjs/platform-express

What changed in @nestjs/platform-express 11 to 12, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

2 breaking9 security2 new APIs and options

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@nestjs/platform-express 127 changes

The Express adapter drains in-flight requests during shutdown.
12.0.0upgrade guide
HTTP adapter error mapping has been reworked across the core, Express, and Fastify adapters; verify dependent behavior with tests.
12.0.0upgrade guide

Nest: Unbounded memory growth in the NestJS TCP microservice transport
11.2.5, 12.0.3security advisory
Nest: Remote process termination via a deeply nested microservice message pattern
11.2.4, 12.0.2security advisory
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
11.2.4, 12.0.2security advisory

NestApplicationOptions adds opt-in duplicate-route and shadowing policies, allowing Express applications to warn about or reject route conflicts.
12.0.0upgrade guide
NestApplicationOptions adds an opt-in route resolution strategy; setting it to specificity addresses order-sensitive route matching on Express.
12.0.0upgrade guide

Nest: Middleware Bypass on Fastify via Trailing Slash
11.1.24security advisory
Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)
11.1.19security advisory
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
11.1.18security advisory
Nest Fastify HEAD Request Middleware Bypass
11.1.16security advisory
Nest has a Fastify URL Encoding Middleware Bypass
11.1.14security advisory
Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)
11.1.11security advisory