# What changed in @nestjs/throttler

> 12 changes in @nestjs/throttler 6 from its official release notes, upgrade guides and advisories: 2 breaking, 2 new APIs and options. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/@nestjs/throttler/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @nestjs/throttler 6

### Breaking changes

- With blockDuration: 0, Retry-After reports when the oldest hit expires rather than when the window ends. (6.7.1) — [release notes](https://github.com/nestjs/throttler/releases/tag/v6.7.1)
- The built-in tracker masks IPv6 addresses to a subnet prefix, so clients within that subnet share a rate-limit counter. IPv6 tracker strings change shape, rotating storage keys once on upgrade. (6.7.0) — [release notes](https://github.com/nestjs/throttler/releases/tag/v6.7.0)

### New APIs and options

- Adds a protected method subclasses can override to set rate limit headers; the guard uses res.setHeader() when res.header() is unavailable. (6.7.1) — [release notes](https://github.com/nestjs/throttler/releases/tag/v6.7.1)
- Configure the IPv6 subnet prefix length used by the default tracker. (6.7.0) — [release notes](https://github.com/nestjs/throttler/releases/tag/v6.7.0)

### Behavior and default changes

- Storage no longer retains request contexts through per-hit timers; it records hit expiry times and prunes expired hits on access, and the idle-record sweep is no longer tied to the first request's context. (6.7.1) — [release notes](https://github.com/nestjs/throttler/releases/tag/v6.7.1)
- Idle records are removed after their window fully elapses and all pending hits and blocks have expired, preventing the in-memory map from growing indefinitely. (6.7.0) — [release notes](https://github.com/nestjs/throttler/releases/tag/v6.7.0)

### Tooling

- Declares the supported Node versions in package engines, matching the range tested by the CI matrix. (6.6.0) — [release notes](https://github.com/nestjs/throttler/releases/tag/v6.6.0)

### Fixes and other changes

- Numeric strings are coerced to numbers, and an explicit 0 is respected; with blockDuration: 0, rejected requests are not recorded and can pass as soon as the oldest hit expires. (6.7.1) — [release notes](https://github.com/nestjs/throttler/releases/tag/v6.7.1)
- Numeric strings are coerced to numbers, and an explicit 0 in @Throttle() or module options is respected instead of falling back to the default. (6.7.1) — [release notes](https://github.com/nestjs/throttler/releases/tag/v6.7.1)
- The guard logs a warning at boot when no throttler is configured; it otherwise limits nothing. (6.7.1) — [release notes](https://github.com/nestjs/throttler/releases/tag/v6.7.1)
- Numeric strings are coerced to numbers, and an explicit 0 in @Throttle() or module options is respected instead of falling back to the default. (6.7.1) — [release notes](https://github.com/nestjs/throttler/releases/tag/v6.7.1)
- Updates the package to support Nest version 12. (6.6.0) — [release notes](https://github.com/nestjs/throttler/releases/tag/v6.6.0)