# What changed in @nestjs/testing

> 11 changes in @nestjs/testing 11 to 12 from its official release notes, upgrade guides and advisories: 1 breaking, 9 security. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/@nestjs/testing/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @nestjs/testing 12

### Breaking changes

- Jest can load the ESM-only v12 packages only on Node.js v24.9 or later; older versions fail with ERR_REQUIRE_ASYNC_MODULE. (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)

### Security

- Nest: Unbounded memory growth in the NestJS TCP microservice transport (11.2.5, 12.0.3) — [security advisory](https://github.com/advisories/GHSA-96H4-VGXJ-GVM2)
- Nest: Remote process termination via a deeply nested microservice message pattern (11.2.4, 12.0.2) — [security advisory](https://github.com/advisories/GHSA-M8VH-JMQ9-5RJG)
- @nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets (11.2.4, 12.0.2) — [security advisory](https://github.com/advisories/GHSA-9C5C-9QCX-Q35Q)

### Tooling

- Vitest is now the primary default for ESM workflows and is used by generated ESM projects; @nestjs/testing remains test-runner agnostic. (12.0.0) — [upgrade guide](https://docs.nestjs.com/migration-guide)

## @nestjs/testing 11

### Security

- Nest: Middleware Bypass on Fastify via Trailing Slash (11.1.24) — [security advisory](https://github.com/advisories/GHSA-6V32-FJC9-9QF6)
- Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport) (11.1.19) — [security advisory](https://github.com/advisories/GHSA-HPWF-8G29-85QM)
- @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection') (11.1.18) — [security advisory](https://github.com/advisories/GHSA-36XV-JGW5-4Q75)
- Nest Fastify HEAD Request Middleware Bypass (11.1.16) — [security advisory](https://github.com/advisories/GHSA-WF42-42FG-FG84)
- Nest has a Fastify URL Encoding Middleware Bypass (11.1.14) — [security advisory](https://github.com/advisories/GHSA-R4WM-X892-VJMX)
- Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU) (11.1.11) — [security advisory](https://github.com/advisories/GHSA-8WPR-639P-CCRJ)