# What changed in @nestjs/platform-fastify

> 12 changes in @nestjs/platform-fastify 11 to 12 from its official release notes, upgrade guides and advisories: 2 breaking, 9 security. Each one cited. Sources checked 2026-11-01. HTML: https://unstale.sh/npm/@nestjs/platform-fastify/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @nestjs/platform-fastify 12

### Breaking changes

- Nest packages ship as ESM; CommonJS applications can consume them through require(esm) on supported Node.js versions. (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)
- Running a Nest 12 application requires Node.js v20.19+ or v22.12+ on the 22.x line. (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)

### Security

- Nest: Unbounded memory growth in the NestJS TCP microservice transport (11.2.5, 12.0.3) — [security advisory](https://github.com/advisories/GHSA-96H4-VGXJ-GVM2)
- Nest: Remote process termination via a deeply nested microservice message pattern (11.2.4, 12.0.2) — [security advisory](https://github.com/advisories/GHSA-M8VH-JMQ9-5RJG)
- @nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets (11.2.4, 12.0.2) — [security advisory](https://github.com/advisories/GHSA-9C5C-9QCX-Q35Q)

### Behavior and default changes

- HTTP adapter error mapping has been reworked across the core, Express, and Fastify adapters. (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)

## @nestjs/platform-fastify 11

### Security

- Nest: Middleware Bypass on Fastify via Trailing Slash (11.1.24) — [security advisory](https://github.com/advisories/GHSA-6V32-FJC9-9QF6)
- Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport) (11.1.19) — [security advisory](https://github.com/advisories/GHSA-HPWF-8G29-85QM)
- @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection') (11.1.18) — [security advisory](https://github.com/advisories/GHSA-36XV-JGW5-4Q75)
- Nest Fastify HEAD Request Middleware Bypass (11.1.16) — [security advisory](https://github.com/advisories/GHSA-WF42-42FG-FG84)
- Nest has a Fastify URL Encoding Middleware Bypass (11.1.14) — [security advisory](https://github.com/advisories/GHSA-R4WM-X892-VJMX)
- Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU) (11.1.11) — [security advisory](https://github.com/advisories/GHSA-8WPR-639P-CCRJ)