npm / @nestjs/testing

@nestjs/testing

What changed in @nestjs/testing 11 to 12, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

1 breaking9 security1 tooling

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@nestjs/testing 125 changes

Jest can load the ESM-only v12 packages only on Node.js v24.9 or later; older versions fail with ERR_REQUIRE_ASYNC_MODULE.
12.0.0upgrade guide

Nest: Unbounded memory growth in the NestJS TCP microservice transport
11.2.5, 12.0.3security advisory
Nest: Remote process termination via a deeply nested microservice message pattern
11.2.4, 12.0.2security advisory
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
11.2.4, 12.0.2security advisory

Vitest is now the primary default for ESM workflows and is used by generated ESM projects; @nestjs/testing remains test-runner agnostic.
12.0.0upgrade guide

Nest: Middleware Bypass on Fastify via Trailing Slash
11.1.24security advisory
Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)
11.1.19security advisory
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
11.1.18security advisory
Nest Fastify HEAD Request Middleware Bypass
11.1.16security advisory
Nest has a Fastify URL Encoding Middleware Bypass
11.1.14security advisory
Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)
11.1.11security advisory