v12.5.0 (2026-11-12)

Notable changes

New options

• WsAdapter takes maxPayload, the largest message a client may send (1 MB by default, was 100 MB; a gateway's own maxPayload takes precedence, 0 lifts the limit); a larger message closes the connection with code 1009 – 109e52cd9b
• IoAdapter takes maxWaitingMessages, the number of a client's messages of one event that may wait beyond those being handled (10,000 by default; Infinity lifts it) – c98b5f782e
• TCP server: maxConcurrentMessages (1000 per connection by default; 0 lifts it) – 42c619cd69
• gRPC server: maxPendingResponses (1000 by default; 0 disables), after which a streaming call whose client leaves its responses unread fails with RESOURCE_EXHAUSTED – ce6d44d858
• Redis server: maxWildcardChannelLength (1024 characters by default; 0 disables) for requests matched through a wildcard subscription – 074dcf7c60
• RabbitMQ: maxMessageSize (16 MiB by default) for messages and replies decoded as JSON – da6b3fc5bc
• @nestjs/platform-fastify: multipart limits.jsonFieldsSize (1 MiB by default) for the fields of a request sent as application/json – 958316696f

New defaults and behaviour changes

• TCP: maxBufferSize defaults to 16 Mi characters (was 128 Mi), in both directions – 55da0b0d33 – and now applies to each packet rather than to everything received in one read, so a burst of small packets no longer closes the connection (#18502) – ce285e6ad3
• TCP server: an empty or unset host now listens on localhost; set host: '0.0.0.0' (or '::') to listen on every interface – 4196d3655d
• @nestjs/platform-express, @nestjs/platform-node: multipart requests default to at most 1000 parts, which also caps a fields, files or maxCount above 1000 unless limits.parts is raised – b2bbc17122
• An upload option a route sets to undefined or null now keeps the module's value; use Infinity to lift a limit – 7bc8d9121e
• A limit option given as NaN (e.g. Number(process.env.UNSET)) now gets its default instead of turning the limit off, for TCP, Kafka, WsAdapter, IoAdapter, the validation pipes and @Sse() – 8209d1c8be, f956177a0e, 5b58a6e89f
• ClassSerializerInterceptor and StandardSchemaSerializerInterceptor serialize each object a streamed HTTP response yields, so @Exclude(), groups and schemas apply to every line of NDJSON – 8217f2b3b8
• @Sse(): while Node.js has paused the socket of a client, a : comment is written every 5 s, so that a client that left is noticed – cd963b19bd
• @nestjs/platform-express, @nestjs/platform-node: a SyntaxError or URIError without a 400 status (e.g. thrown by a middleware passed to app.use()) is answered with a logged 500 rather than a 400 carrying its message – 8d74ddcd3a
• @nestjs/platform-node: when the matched route would leave a route parameter empty, the request is a 404 – 56c06f48c3
• Middleware given to forRoutes() is mounted where the router serves the routes it covers, including routes excluded from the global prefix – 521cdea80f
• Parameter pipes of controllers built with mixins or wrapped by a class decorator that returns a Proxy now run – 7c5792d969
• The exclude predicate of enableCsrfProtection() excludes a request only when it returns true – 608fcec0a9
• Gateways on their own port drop clients that connect before onApplicationBootstrap() has finished; socket.io clients reconnect – 7d705cc835
• In a standalone microservice, a gateway without a port no longer opens a server on a random port; it gets a server that does not listen – 7359d3b06a
• An @Optional() dependency that exists but fails to build at request time now fails its consumer – 0c360708b5
• Transient providers with durable dependencies are built per request – 822d93ffd1
• moduleRef.create() rejects a request-scoped property dependency, as it does for constructor parameters – 6c5fed8b72

New startup errors and warnings

• A guard, interceptor or pipe that can't run (e.g. an abstract class used as a token, or a class given as the useValue of APP_GUARD) fails the application at startup; an exception filter that can't run logs a warning – 7a81aed500, 407518855f
• An invalid forRoutes() or exclude() entry fails the application at startup – 1afb768959
• A gateway that joins a shared server with a verifyClient or allowRequest the server won't run, or gateways on one port that set different hosts, stop the application at startup – 32875410dc, fd0155fba0
• @nestjs/platform-fastify: @All('x') declared above @Search('x') or a WebDAV method on the same path fails at startup, as the reverse order already did; @All() routes now also answer these methods – a1695d18ea
• Warnings for exception filter classes bound to a middleware, which don't apply – 3113f03f1e – and for a ValidationPipe that gets no parameter types – f433a1f752

Microservices

• gRPC: an Error wrapped in an RpcException is logged and answered as "Internal server error"; its numeric code is still used as the status – 2038bff425
• A filter that throws on a response stream is logged and answered as "Internal server error" – 515f99cfb6
• Kafka: events can no longer ask for a reply through reply headers, and replies no longer carry them – d1473338c3; an object with a key or value and other properties is sent as the payload – 73373dc911; a request whose reply topic is one the server handles itself is dropped – 809029b74b
• RabbitMQ wildcards: a message whose pattern names a different handler than its routing key is not handled – ef8f92c5d0
• Patterns with a string value over 4096 characters or more than 100 keys get a marker route – ed8ca5cded; multi-key patterns with a non-ASCII key may get a new route, so clients and servers of such patterns should be on the same version – 015456cc2f

@nestjs/core and the platform packages should be updated together, as the adapters pass new route matching options to core.

Bug fixes

• platform-fastify
  • fecdd4f9ef fix(fastify): fail an object-mode file stream on a non-bytes chunk (@kamilmysliwiec)
  • 5f08564c8b fix(fastify): release file streams of pipelined requests on close ([@kamilmysliwiec](https://github.com/kamilmys...

What's changed

• @nestjs/common
  • fix(common): let a null depth print every level in the console logger — backport of #18480
  • fix(common): count empty strings toward the json log record cap
  • fix(common): check the json log record cap before converting values
  • fix(common): limit the error messages of parsed array items in total
  • fix(common): rethrow non-validation errors in the parse array pipe
  • fix(common): drop the value of validation errors that have children
  • fix(common): reject a buffer sent in place of a validated class
  • fix(common): reject a buffer held by a nested validated property
  • fix(common): validate a stand-in for a buffer sent as the whole value
  • fix(common,core): use the default for pipe and sse limits given as nan
  • fix(common): validate the files of parse file pipe one at a time
  • fix(common): close the gaps of sparse arrays the pipes validate
  • fix(common,core): count sse events without data toward the pending limit
  • fix(common,core): send the status text in sse errors that wrap an error
  • fix(common): keep the scope a class declares when passed to mixin()
• @nestjs/core
  • fix(core): listen for the error of every stream the router holds
  • fix(core): share one close listener among the requests of a connection
  • fix(core): send what the interceptors return for a streaming handler
  • fix(core): catch what the teardown of an sse producer throws
  • fix(core): write the waiting events of an sse client in linear time
  • fix(core): notice an sse client that left while its socket is paused
  • fix(core): keep host params matched next to an optional group
  • fix(core): answer http errors that graphql or async rpc filters leave
  • fix(core): skip exception filters that were not created for a request
  • fix(core): keep a controller root route next to an optional-tail route
  • fix(core,fastify): exclude "/x/" only when no other route may serve it
  • fix(core,fastify,node): match excluded params up to the router's limit
  • fix(core,fastify): end the excluded path at ";" like the fastify router
  • fix(core,fastify): match the text after an excluded param as written
  • fix(core): run the middleware for a path with a line terminator
  • fix(core): mount middleware where the router serves the covered routes
  • fix(core): test each versioned path against the prefix exclusions alone
  • fix(core): keep the filters of a middleware's use() with exclude()
  • fix(core): warn that filter classes bound to a middleware do not apply
  • fix(core): reject a middleware target that is not a controller or route — such an entry now fails the application at startup
  • fix(core): mount module middleware in order when configure() awaits
  • fix(core): resolve a forward reference to a module only once
  • fix(core): mount a controller root route without the slash after a tail
  • fix(core): mount middleware on a route path that really ends in "$"
  • fix(core): keep create() working after many calls in snapshot mode
  • fix(core): give unserializable dynamic modules their own deep-hash ids
  • fix(core): build a lazy module once when loads overlap
  • fix(core): fail the consumer when an optional dependency fails to load
  • fix(core): keep transient instances out of durable sub-trees
  • fix(core): inject the strategy payload into durable providers as request
  • fix(core): inject the provider an alias stands for
  • fix(core,websockets): read parameter metadata from the declaring class
  • fix(core,common): read the catch types of a filter from its prototype
  • fix(core): warn when a validation pipe gets no parameter types
  • fix(core): use the enhancers of the module that holds the host
  • fix(core): run the container instance of a class-bound enhancer
  • fix(core): throw for a guard, interceptor or pipe that can't run — such a binding now fails the application at startup
  • fix(core,microservices,websockets): drop gateway clients during startup
  • fix(core): warn about an exception filter that can't run
  • fix(core): settle sse lifecycle on early disconnect — backport of #17987
  • fix(core): let exclusions cover routes excluded from the global prefix — backport of #18209
  • fix(core): compare a prefix exclusion with a trailing slash as served
  • fix(core): release the throwaway wrapper of each create() call — backport of #18137
  • fix(core): reject create() when a dependency is request-scoped — backport of #18142
  • fix(core): find the module of a host registered under another token
  • fix(core): roll back modules on failed lazy load — backport of #18385
  • fix(core): reject create() when a property dependency is request-scoped
  • fix(core): release removed wrappers from the providers they depended on
  • [fix(core): use the enhancers of the module that holds the host](https...

v12.4.1 (2026-11-09)

Features

• platform-node
  • #18435 feat(node): inject requests into the node adapter like the fastify one (@thekhegay)
  • #18439 feat(node): set req.route on the node adapter like express does (@thekhegay)

Bug fixes

• core
  • #18385 fix(core): roll back modules on failed lazy load (@Asadshah7950)

Enhancements

• common, core
  • #18429 fix(core,common): warn when decorator metadata is missing (@kamilmysliwiec)

Dependencies

• platform-ws
  • #18468 chore(deps): bump ws from 8.22.0 to 8.22.1 (@dependabot[bot])

Committers: 8

• Abdellatif Anaflous (@hktitof)
• Asad Ali Shah (@Asadshah7950)
• G (@gjija)
• Kamil Mysliwiec (@kamilmysliwiec)
• Maksym Lyskov (@maxymlyskov)
• Roman Khegay (@thekhegay)
• Thiago Nascimento (@ThiagoACNascimento)
• WooSeung Kim (@beyondwin)

What's changed

• @nestjs/core
  • fix(core): run wildcard middleware on excluded routes of every version
• @nestjs/platform-express
  • fix(deps): update dependency multer to v2.5.0 — resolves GHSA-q7qp-rjg7-q26m (#18421)
• @nestjs/platform-fastify
  • fix(fastify): end the authority of absolute-form targets at the query — an absolute-form request target with a / after a query that comes before its path is now answered with 404
  • fix(deps): update dependency fastify to v5.12.8 — resolves the advisories published against fastify up to 5.12.4; find-my-way moves to 9.10.0 with it, so http://host?a=b is now routed as /

v12.4.0 (2026-11-06)

Features

• platform-node
  • #18396 feat(node): let the node adapter set locals for every view (@thekhegay)

Bug fixes

• microservices
  • #18418 fix(microservices): ignore an mqtt server's own replies under wildcards (@pavstev)
  • #18413 fix(microservices): reach handlers whose string pattern reads as json (@pavstev)
  • #18392 fix(microservices): forward grpc call options on request streams (@DenisCDev)
  • #18393 fix(microservices): await the mqtt close and reset the client state (@hktitof)
• common
  • #18419 fix(common): keep the fields of grouped item errors in parse array pipe (@pavstev)
  • #18402 fix(common): keep console logger from mutating the caller options (@pavstev)
• platform-node
  • #18417 fix(node): omit the Content-Length of a redirect with a Transfer-Encoding (@hktitof)
  • #18415 fix(node): give each route that shares a path shape its own params (@pavstev)
  • #18372 fix(node): strip trailing slashes when resolving view names (@saiyam-jain-dev)
  • #18403 fix(node): omit content-length when transfer-encoding is set (@pavstev)
  • #18395 fix(node): render with eta, liquidjs and art-template (@thekhegay)
  • #18391 fix(node): add the charset to a content type the app sets (@pavstev)
• platform-fastify
  • #18414 fix(fastify): answer 403 for a path the static plugin refuses (@pavstev)
• core, testing
  • #18410 fix(core): apply a provider override whose value is undefined (@pavstev)
• platform-express, platform-fastify, platform-node
  • #18400 fix(express,node,fastify): declare rxjs as a peer dependency (@ryodine)
• core
  • #18407 fix(core): run middleware on subpaths next to an all-methods route (@beyondwin)
  • #18401 fix(core): cache external handler metadata per context type (@kamilmysliwiec)

Enhancements

• common, core
  • #18427 feat(core,common): send a web response or stream a handler returns (@kamilmysliwiec)

Dependencies

• platform-fastify
  • #18422 fix(deps): update dependency @fastify/cors to v11.4.1 (@renovate[bot])

Committers: 8

• Abdellatif Anaflous (@hktitof)
• Denis Scarabelli (@DenisCDev)
• Kamil Mysliwiec (@kamilmysliwiec)
• Roman Khegay (@thekhegay)
• Ryan Johnson (@ryodine)
• Saiyam Jain (@saiyam-jain-dev)
• Stevan Pavlović (@pavstev)
• WooSeung Kim (@beyondwin)

v12.3.0 (2026-10-27)

Features

• platform-node
  • #18063 feat(node): add a native node http platform adapter (@kamilmysliwiec)

Bug fixes

• common
  • #18289 fix(common): report the detected file type in file type errors (@DenisCDev)
  • #18246 fix(common): avoid throwing for arrow prototype constructors (@fengxueweilai)
  • #18220 fix(common): abort the response when a streamable file fails midway (@thekhegay)
• core
  • #18276 fix(core): run middleware once for routes that differ only in version (@OmBhandwaldar)
  • #18262 fix(core): tolerate sse request sockets without tuning methods (@SnowingFox)
  • #18252 fix(core): read the url protocol from the server (@thekhegay)
  • #18254 fix(core): name the array and index of undefined module entries (@thekhegay)
  • #18235 fix(core): discover classes by each of their discovery decorators (@OmBhandwaldar)
  • #18216 fix(core): read the abort on error option of the app being called (@thekhegay)
  • #18209 fix(core): let middleware exclusions cover prefix-excluded routes (@thekhegay)
  • #18210 fix(core): honor abortOnError passed to select() (@Cayan)
  • #18215 fix(core): subscribe to handler observables from other rxjs copies (@koreahghg)
  • #18201 fix(core): read a quoted media type version in the middleware exclusions (@hktitof)
  • #18200 fix(core): resolve request-scoped forward refs for concurrent requests (@maxymlyskov)
• common, microservices, platform-ws
  • #18285 fix(ws,microservices): load packages where bundlers can see them (@kamilmysliwiec)
• common, microservices, websockets
  • #18272 fix(common): keep one route param per argument in an overriding method (@maxymlyskov)
• platform-express
  • #18264 fix(express): map unsupported multipart content types to 415 (@seren-wib)
  • #18234 fix(express): end a head response for an empty streamable file (@spokodev)
  • #18232 fix(express): leave 5xx http-errors errors unmapped so they are logged (@kamilmysliwiec)
  • #18214 fix(platform-express): map http-errors exceptions to HttpException in Express adapter (@okxint)
  • #18199 fix(express): send the standard body for an exception wrapping an error (@KAPUIST)
• platform-fastify
  • #18253 fix(fastify): send object error bodies with a json content type (@maxymlyskov)
  • #18240 fix(fastify): leave 5xx fastify errors unmapped so they are logged (@thekhegay)
  • #18239 fix(fastify): map 4xx http-errors errors to http exceptions (@kamilmysliwiec)
  • #18226 fix(fastify): listen on a file descriptor (@thekhegay)
  • #18217 fix(fastify): run cors before nest middleware (@kamilmysliwiec)
• core, platform-express, platform-fastify, platform-socket.io, platform-ws, websockets
  • #18251 fix(core,express,fastify,ws,socket.io): load adapters with an older core (@thekhegay)
• microservices
  • #18250 fix(microservices): re-arm the redis retries on a new listen (@hktitof)
  • #18255 fix(microservices): report a nats connection that gave up reconnecting (@thekhegay)
  • #18249 fix(microservices): do not emit a trailing null to kafka requesters (@thekhegay)
  • #18256 fix(microservices): let a retriable exception keep travelling (@hktitof)
  • #18238 fix(microservices): retry the tcp server again after close and listen (@kamilmysliwiec)
  • #18223 fix(microservices): clear the tcp retry timer when a new listen starts (@hktitof)
  • #18221 fix(microservices): honor mqtt topic filter boundaries (@fabric0de)
  • #18229 fix(microservices): let only the exact message handler answer a request (@maxymlyskov)
  • #18211 fix(microservices): fail the request when its last reply cannot be sent (@maxymlyskov)
  • #18206 fix(microservices): reset the tcp retry attempts on each listen (@hktitof)
  • #18204 fix(microservices): count every failed rmq connection attempt (@maxymlyskov)
  • #18197 fix(microservices): send the record headers of nats as message headers (@hktitof)

Dependencies

• platform-express
  • #18268 fix(deps): update dependency multer to v2.5.0 [security] (@renovate[bot])
• common
  • #18257 fix(deps): update dependency file-type to v22.2.0 (@kamilmysliwiec)
• platform-fastify
  • #18219 fix(deps): update dependency @fastify/middie to v9.3.6 (@renovate[bot])

Committers: 16

• Abdellatif Anaflous (@hktitof)
• Daniel Pinto (@Cayan)
• Denis Scarabelli (@DenisCDev)
• Junpei Zhang (@pei711)
• Kamil Mysliwiec (@kamilmysliwiec)
• Luke Son (@KAPUIST)
• Maksym Lyskov (@maxymlyskov)
• Om Bhandwaldar (@OmBhandwaldar)
• Roman Khegay (@thekhegay)
• Spoko Dev (@spokodev)
• @fengxueweilai
• @okxint
• snowingfox (@SnowingFox)
• yooseong (@seren-wib)
• 김정현 (Kim JungHyeon) (@fabric0de)
• 한국 (@koreahghg)

What's changed

• @nestjs/common
  • fix(common): reject non-numeric items in ParseArrayPipe with items Number — backport of #17876
  • fix(common): reject arrays nested in ParseArrayPipe items — backport of #18073
  • fix(common): skip array holes when stripping prototype keys
  • fix(common): copy array and object defaults in DefaultValuePipe
  • fix(common): cut json log records short past a million characters
  • fix(common): strip a falsy constructor key from request data
  • fix(common): validate parsed array items one at a time
  • fix(common): stop copying nested validation errors for each level
  • fix(common): reject arrays and primitives for validated classes
  • fix(common): limit the length of validation error messages by default
  • fix(common): stop exposing the validated object on validation errors
  • fix(common): match a file type string up to the end of a name
  • fix(common): handle StreamableFile errors raised before the reply
  • fix(common): keep StreamableFile error messages out of responses
  • fix(common): abort the response when a streamable file fails midway — backport of #18220
• @nestjs/core
  • fix(core,express,fastify): match excluded routes like the router does
  • fix(core): match excluded routes exactly when the router is unknown
  • fix(core): answer host mismatches on fastify with 404
  • fix(core): never exclude request targets with "#" or in absolute form
  • fix(core): mount unversioned middleware paths under the default version
  • fix(core): map controller middleware under every module declaring it
  • fix(core): mount transient-scoped middleware instead of skipping it — on v11 this also mounts the middleware listed after a transient one, which was skipped as well
  • fix(core): drop an overlapped middleware route only when it is covered
  • fix(core): mount wildcard middleware on every path when "/" is excluded
  • fix(core): mount middleware paths on routes excluded from the prefix
  • fix(core): stop wildcard exclusions from covering their parent route
  • fix(core): run middleware on a controller root excluded by a wildcard
  • fix(core,common): exclude a version only for requests that ask for it
  • fix(core,microservices,websockets): ignore inherited keys of non-objects
  • fix(core): stop the Observable producer when the client disconnects — backport of #17826
  • fix(core): end sse responses to head requests once headers are sent
  • fix(core): do not send the message of an unexposed http error
  • fix(core): destroy a StreamableFile dropped by a timed-out handler
  • fix(core): destroy a StreamableFile that is not sent
  • fix(core,express,fastify): remove uploads of requests a pipe rejected
  • fix(core): hand sse header errors to the exception filters
  • fix(core): drop sse clients that stop reading their events
  • fix(core): hide internal error messages from sse error events
  • fix(core): make the sse pending data limit configurable
  • fix(core): apply the expose flag of http errors to sse error events
  • fix(core,microservices): run transient global enhancers on controllers — backport of #17993
  • fix(core): stop silently dropping request-scoped global enhancers — backport of #18066; a global enhancer whose dependency tree is request-scoped is no longer silently skipped
  • fix(core): fail at startup for request-scoped class global enhancers — backport of #18104; such an enhancer (e.g. APP_GUARD with useClass) now fails at startup instead of running without its dependencies
  • fix(core): read class-level enhancers from the registered class
  • fix(core): apply the enhancers of class providers under any token
  • fix(core): run enhancers that are request-scoped through dependencies
  • fix(core): fail at startup when a global enhancer is not instantiated
  • fix(core): run transient global enhancers on static entry providers
  • fix(core,websockets): run transient enhancers bound to static gateways
  • fix(core): run guards bound as classes without a name
  • fix(core): subscribe to guard observables from other copies of rxjs
  • fix(core): run interceptor, pipe and filter classes without a name
• @nestjs/platform-express
  • fix(express): run wildcard middleware on "/api/" for a named wildcard
  • fix(express): apply middleware to controller root routes in strict mode
  • fix(express): map multer array index and invalid field name codes to 400 — backport of #17857
  • fix(express): destroy the StreamableFile source on client disconnect — backport of #17973
  • fix(express): send object error bodies with a json content type
  • fix(express,fastify): handle a StreamableFile that cannot be streamed
  • fix(express): stop reading a streamable file for a head request
• @nestjs/platform-fastify
  • fix(fastify): treat an empty route parameter as a route miss
  • fix(fastify): answer request targets that are not a path with 404
  • [fix(fastify): pass mi...

v12.2.0 (2026-10-19)

Notable changes

New options

• @Sse({ maxPendingDataLength }) sets how many characters of event data may wait for a client that is not reading its events (4M by default; 0 or Infinity lifts the limit) – 2f05ad954e
• IoAdapter and WsAdapter take maxConcurrentMessages, the number of a client's messages handled at once (1000 by default; Infinity lifts it) – 0bd0810ed7
• ValidationPipe takes maxErrorMessagesLength (1,000,000 characters by default); messages past it are replaced by a "Further validation errors were omitted" entry – 086c1c514f
• Kafka: parser.maxMessageSize (16 MiB after decompression by default); larger messages are logged and skipped – 9bdf844fca
• TCP server: drainTimeout (30 s by default, 0 disables) disconnects a peer that leaves its responses unread – 583d6077ad
• MQTT server: reconnectOnConnackError is now enabled by default, so a refused connection attempt is retried; set it to false for the previous behaviour – a63cea600a
• HttpServer.getRouteMatchingOptions(), an optional adapter hook that tells core how the router matches paths (see "Middleware exclusions" below) – 08d8677c8d

New defaults and behaviour changes

• @nestjs/platform-express, @nestjs/platform-fastify: fieldNestingDepth and fieldArrayIndexLimit (#18074) now default to 32 and 1000; set them to Infinity to lift the limits – 94fcc93770
• ValidationPipe validates with validationError.target: false unless the options set it, so an exceptionFactory that reads error.target gets undefined; set validationError.target to true for the old errors – 8c5a59bf63
• ValidationPipe answers an array or a primitive sent for a validated class with a 400 – 197371c1f3
• FileTypeValidator matches a string fileType up to the end of a name (e.g. font/woff no longer accepts font/woff2; use a RegExp for that) – 770c6f1a19
• @SerializeOptions({}) on a handler no longer turns off the class schema – d27cb7017f
• BaseExceptionFilter answers http-errors errors created with expose: false (the default from 500) with the standard reason phrase instead of their message – 9ed572f853
• A StreamableFile error still gets a 400, but the body no longer carries the error message – 2f28d91afb
• Files uploaded with a request that a pipe rejected are removed from storage – acb98de89e
• @nestjs/platform-fastify: a route with fileSize: undefined (or null) falls back to the plugin's limit; set it to Infinity to keep uploads unlimited – dd549e1a74
• @nestjs/platform-express: object error bodies are sent as application/json on routes with a non-JSON Content-Type – 7dc6e349d5
• ConsoleLogger in JSON mode cuts a record short past about a million characters – ad4915eaa3
• A global enhancer that the injector failed to instantiate now fails the application at startup – ae78524ced
• A request- or transient-scoped APP_FILTER now logs a startup warning, as it only applies to exceptions thrown from controllers – df5275c5e1
• Microservices: a pattern key longer than 256 characters matches no handler – accd27e66c
• Kafka: a message may carry up to 10,000 header values (e419ff540b); headers given as a string or array are not sent (312777743f); reply headers are decoded as text (ee94f6aaae)
• gRPC: request streams are paused while their replies wait to be written – 37e5cf7706
• Deprecation: on TCP, Redis, NATS, MQTT and RabbitMQ, an @EventPattern() handler that replies to ClientProxy#send() now logs a deprecation warning. The reply is unchanged; in the next major version event handlers will not reply to send(), as on Kafka already – ba3668d36b

Middleware exclusions

• MiddlewareConsumer.exclude() now compiles excluded routes with the router's case and trailing-slash matching (08d8677c8d). Update @nestjs/core together with @nestjs/platform-express / @nestjs/platform-fastify: with an adapter that does not implement getRouteMatchingOptions(), excluded routes are matched exactly (f5aa875e40), so on a lenient router other spellings of an excluded path run the middleware.
• With header, media type or custom versioning, exclude({ path, method, version }) and enableCsrfProtection({ exclude }) apply only to requests that ask for one of the excluded versions – 1a7a31fa46
• @nestjs/platform-fastify: the request hook used by enableCsrfProtection() and useSecurityHeaders() now runs before Nest and app.use() middleware with NestFactory.create() too, including middleware registered before either call, as it already did with Test.createNestApplication() – 8351806290

Bug fixes

• platform-fastify
  • 614d1ac7ea fix(fastify): send the status of an exception whose body is an error (@kamilmysliwiec)
  • 8b420f788f fix(fastify): apply middleware to plugins registered before init (@kamilmysliwiec)
  • #18175 fix(fastify): keep raw-response cookies in the header helpers (@johnnyhuirilef)
  • c215fd9b4f fix(fastify): match middleware paths like a case-insensitive router (@kamilmysliwiec)
  • 43d4420205 fix(fastify): pass version extractor errors to the error handler (@kamilmysliwiec)
  • 1435ed22f4 fix(fastify): pass middleware rejections to the error handler (@kamilmysliwiec)
  • 84c947faf9 fix(fastify): stop reading a streamable file for a head request (@kamilmysliwiec)
  • dd549e1a74 fix(fastify): let undefined upload limits fall back to the defaults (@kamilmysliwiec)
  • 4735f8d050 fix(fastify): free memory storage chunks once a file is buffered (@kamilmysliwiec)
  • 3e3e6eea6f fix(fastify): remove uploads cut off after their last chunk (@kamilmysliwiec)
  • c04a9182b9 fix(fastify): set the security headers on router error responses (@kamilmysliwiec)
  • a03c7a1db6 fix(fastify): answer request targets that are not a path with 404 (@kamilmysliwiec)
  • #18156 fix(fastify): apply route options to all-method routes (@Ahmad-Mosha)
• microservices
  • [#18182](https://github.com/nestjs/...

v12.1.3 (2026-10-12)

Bug fixes

• core, microservices
  • #18111 fix(core,microservices): flush buffered logs when initialization fails (@thekhegay)
  • #17993 fix(core,microservices): run transient global enhancers on controllers (@johnnyhuirilef)
• platform-express
  • #18110 fix(express): guard async request hook completion (@GiHoon1123)
  • #17973 fix(express): destroy the StreamableFile source on client disconnect (@maxymlyskov)
  • #17942 fix(express): run wildcard middleware on the bare global prefix path (@Chaoqi31)
• core
  • #18104 fix(core): fail at startup for request-scoped class global enhancers (@thekhegay)
  • #18066 fix(core): stop silently dropping request-scoped global enhancers (@OmBhandwaldar)
  • #18072 fix(core): resolve uri versioned exclusions for the not-found handler (@basteez)
  • #18075 fix(core): normalize slashes when mapping controllers for middleware (@basteez)
  • #18086 fix(core): do not mutate the message when assigning an sse event id (@Metehan-Bicer)
  • #18025 fix(core): end sse streams whose event data cannot be serialized (@OmBhandwaldar)
  • #18011 fix(core): send status and headers set by handlers on sse responses (@johnnyhuirilef)
  • #18021 fix(core): honor a shutdown signal received while close() is in flight (@maxymlyskov)
  • #17987 fix(core): settle SSE lifecycle on early disconnect (@jackie-cqz)
  • #17986 fix(core): commit SSE headers for empty streams (@jackie-cqz)
  • #17978 fix(core): preserve explicit null values in reflectable decorators (@gophersg)
  • #17966 fix(core): run the shutdown sequence after a failed init (@kamilmysliwiec)
  • #17963 fix(core): send the expires header on sse responses (@Mohamed-Elshesheny)
  • #17953 fix(core): honor global prefix exclusions for overlapping versions (@Chaoqi31)
  • #17950 fix(core): let a GET middleware exclusion cover HEAD requests (@Chaoqi31)
  • #17951 fix(core): reset the listening state when the application closes (@Chaoqi31)
  • #17945 fix(core): hash Map, Set and RegExp options in deep-hash tokens (@Chaoqi31)
  • #17947 fix(core): treat VERSION_NEUTRAL in middleware routes as no version (@Chaoqi31)
  • #17941 fix(core): turn off express x-powered-by in useSecurityHeaders() (@Chaoqi31)
  • #17939 fix(core): name dynamic host modules in import error messages (@Chaoqi31)
  • #17940 fix(core): isolate nested transient providers injected into properties (@Chaoqi31)
• microservices
  • #18108 fix(microservices): keep nats status updates alive when a listener throws (@kamilmysliwiec)
  • #18100 fix(microservices): default server options like the client factory does (@thekhegay)
  • #18083 fix(microservices): match rmq '#' wildcards in any position (@thekhegay)
  • #18095 fix(microservices): fail mqtt requests whose publish fails (@izg0820)
  • #18085 fix(microservices): preserve null payloads in kafka tombstone records (@Hangell)
  • #18081 fix(microservices): close the connection when the channel close fails (@hktitof)
  • #18071 fix(microservices): return the rmq reply publish so failures are handled (@maxymlyskov)
  • #18060 fix(microservices): fail redis listen on rejected subscriptions (@kamilmysliwiec)
  • #18056 fix(microservices): clone the kafka record before serializing (@Mihir-Rabari)
  • #18054 fix(microservices): do not crash when the redis connection drops (@maxymlyskov)
  • #18043 fix(microservices): fail pending kafka request on deserializer error (@hktitof)
  • #18002 fix(microservices): wait for the TCP TLS handshake (@jackie-cqz)
  • #17995 fix(microservices): survive custom deserializer errors in clients (@johnnyhuirilef)
  • #18027 fix(microservices): close both kafka client connections when one fails (@izg0820)
  • #18008 fix(microservices): unwrap records returned by message handlers (@johnnyhuirilef)
  • #18001 fix(microservices): wait for both Redis clients to be ready (@jackie-cqz)
  • #18000 fix(microservices): ignore stale NATS status events (@jackie-cqz)
  • #17996 fix(microservices): preserve MQTT payload options (@jackie-cqz)
  • #17989 fix(microservices): suspend incomplete packet timers during backpressure (@jackie-cqz)
  • #17988 fix(microservices): cancel pending TCP retries on close (@jackie-cqz)
  • #17972 fix(microservices): keep grpc response errors out of the request stream (@drakeo338)
  • #17957 fix(microservices): fail rmq connect and listen on channel setup errors (@johnnyhuirilef)
  • #17961 fix(microservices): run every event handler when a sibling completes empty (@johnnyhuirilef)
  • #17959 fix(microservices): fail nats requests on undecodable replies (@johnnyhuirilef)
  • #17955 fix(microservices): stop rmq client opening two channels on connect (@johnnyhuirilef)
  • #17946 fix(microservices): answer client-streaming calls that return nothing (@Chaoqi31)
  • #17943 fix(microservices): resolve grpc stream calls that complete empty (@hktitof)
• platform-fastify
  • #18109 fix(fastify): answer the shutdown hooks 503 with fastify's json body (@kamilmysliwiec)
  • #18101 fix(fastify): honor return503OnClosing during the shutdown hooks (@thekhegay)
  • #18059 fix(fastify): reject listen() on an invalid port (@kamilmysliwiec)
  • #18053 fix(fastify): listen on a socket path (@johnnyhuirilef)
  • #17997 fix(fastify): settle async lifecycle hooks once (@jackie-cqz)
  • [#17998](https://github.com/nestj...

v12.1.1 (2026-09-28)

Bug fixes

• common, core, microservices, testing
  • #17893 fix(common): logger bugs in json output, level changes, fatal and buffered logs (@kamilmysliwiec)
• microservices
  • #17891 fix(microservices): let the mqtt client retry after a failed connect (@hktitof)
  • #17888 fix(microservices): keep tcp event listeners across reconnects (@KAPUIST)
  • #17887 fix(microservices): ignore events from a replaced tcp client socket (@KAPUIST)
  • #17878 fix(microservices): keep a newer nats connection when a stale one fails (@hktitof)
  • #17869 fix(microservices): keep a newer kafka connection when a stale one fails (@kamilmysliwiec)
  • #17865 fix(microservices): let the rmq client retry after a failed connect (@hktitof)
  • #17866 fix(microservices): reply on the request channel when redis wildcards are enabled (@fadiroot)
  • #17861 fix(microservices): recover the nats client after it gives up reconnecting (@xia-chao)
• common
  • #17884 fix(common): preserve string enum values matching numeric member names (@KAPUIST)
• core
  • #17871 fix(core): detect circular dependencies across more than two providers (@erezcor)
• platform-fastify
  • #17867 fix(fastify): treat a JSON content type with parameters as JSON in reply() (@fadiroot)
• core, testing
  • #17860 fix(core): honor class and factory overrides of value providers (@lehafari)

Enhancements

• common
  • #17876 fix(common): reject non-numeric items in ParseArrayPipe with items Number (@SulimanAbdulrazzaq)
• microservices
  • #17863 feat(microservices): export deserializers from the package root (@lazerg)

Committers: 13

• Abdellatif Anaflous (@hktitof)
• Alejandro (@lehafari)
• Daniel Pinto (@Cayan)
• Dharmik Sondagar (@DharmikSondagar)
• Kamil Mysliwiec (@kamilmysliwiec)
• Lazizbek Ergashev (@lazerg)
• Luke Son (@KAPUIST)
• Micael Levi L. Cavalcante (@micalevisk)
• Roman Khegay (@thekhegay)
• Suliman Abdulrazzaq (@SulimanAbdulrazzaq)
• Xia Chao (@xia-chao)
• @erezcor
• fadi romdhan (@fadiroot)