npm / @nestjs/websockets

@nestjs/websockets

What changed in @nestjs/websockets 11 to 12, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.

9 security2 new APIs and options

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@nestjs/websockets 125 changes

Nest: Unbounded memory growth in the NestJS TCP microservice transport
11.2.5, 12.0.3security advisory
Nest: Remote process termination via a deeply nested microservice message pattern
11.2.4, 12.0.2security advisory
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
11.2.4, 12.0.2security advisory

handleDisconnect can now receive the reason for the disconnection.
12.0.0upgrade guide
Gateways now support request-scoped providers, with the socket injectable through the REQUEST token.
12.0.0upgrade guide

Nest: Middleware Bypass on Fastify via Trailing Slash
11.1.24security advisory
Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)
11.1.19security advisory
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
11.1.18security advisory
Nest Fastify HEAD Request Middleware Bypass
11.1.16security advisory
Nest has a Fastify URL Encoding Middleware Bypass
11.1.14security advisory
Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)
11.1.11security advisory