# What changed in @nestjs/platform-express

> 13 changes in @nestjs/platform-express 11 to 12 from its official release notes, upgrade guides and advisories: 2 breaking, 9 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/@nestjs/platform-express/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @nestjs/platform-express 12

### Breaking changes

- The Express adapter drains in-flight requests during shutdown. (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)
- HTTP adapter error mapping has been reworked across the core, Express, and Fastify adapters; verify dependent behavior with tests. (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)

### Security

- Nest: Unbounded memory growth in the NestJS TCP microservice transport (11.2.5, 12.0.3) — [security advisory](https://github.com/advisories/GHSA-96H4-VGXJ-GVM2)
- Nest: Remote process termination via a deeply nested microservice message pattern (11.2.4, 12.0.2) — [security advisory](https://github.com/advisories/GHSA-M8VH-JMQ9-5RJG)
- @nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets (11.2.4, 12.0.2) — [security advisory](https://github.com/advisories/GHSA-9C5C-9QCX-Q35Q)

### New APIs and options

- NestApplicationOptions adds opt-in duplicate-route and shadowing policies, allowing Express applications to warn about or reject route conflicts. (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)
- NestApplicationOptions adds an opt-in route resolution strategy; setting it to `specificity` addresses order-sensitive route matching on Express. (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)

## @nestjs/platform-express 11

### Security

- Nest: Middleware Bypass on Fastify via Trailing Slash (11.1.24) — [security advisory](https://github.com/advisories/GHSA-6V32-FJC9-9QF6)
- Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport) (11.1.19) — [security advisory](https://github.com/advisories/GHSA-HPWF-8G29-85QM)
- @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection') (11.1.18) — [security advisory](https://github.com/advisories/GHSA-36XV-JGW5-4Q75)
- Nest Fastify HEAD Request Middleware Bypass (11.1.16) — [security advisory](https://github.com/advisories/GHSA-WF42-42FG-FG84)
- Nest has a Fastify URL Encoding Middleware Bypass (11.1.14) — [security advisory](https://github.com/advisories/GHSA-R4WM-X892-VJMX)
- Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU) (11.1.11) — [security advisory](https://github.com/advisories/GHSA-8WPR-639P-CCRJ)