nest
v12.5.0A progressive TypeScript framework for Node.js backends: from a small API in one file to efficient, scalable, enterprise-grade systems 🚀
- Maintenance
- Active992 commits in 3 months · bus factor 1
- License
- MITPermissive · OSI-approved
- Security
- 19 advisories1 critical, 16 high, 2 medium · Scorecard 7.5/10
- Supported versions
- 2 lines supportednewest 12 · oldest 11 · 4 ended
77.1k stars · 8.7k forks · 46 open issues · last release 3 days ago · data checked 3 hours ago
Security advisories
All advisories on GitHubThe 19 most recent advisories published by the maintainers: 1 critical, 16 high, 2 medium. Check the patched version against the one you run.
- highGHSA-hpvc-wj3g-h9p8Nov 12, 2026Blocked event loop via sparse array field names on the Fastify adapter
- Affected
- >= 12.1.0, < 12.1.3
- Patched in
- 12.1.3
- highGHSA-h94v-c5rc-3pxmNov 12, 2026Process crash via multipart fields parsed as JSON on the Fastify adapter
- Affected
- >= 12.1.0, < 12.5.0
- Patched in
- 12.5.0
- highGHSA-q223-fc7f-xg75Nov 12, 2026Process crash when a handler returns a stream that fails before it is read
- Affected
- >= 12.4.0, < 12.5.0
- Patched in
- 12.5.0
- highGHSA-pqx8-96w4-q4w8Nov 12, 2026Process crash via Socket.IO error replies that echo a message's binary data
- Affected
- >= 12.0.0, < 12.5.0; >= 11.0.0, < 11.2.10
- Patched in
- 12.5.0; 11.2.10
- highGHSA-m25w-q28w-j8fpNov 12, 2026Process crash via a large WebSocket message to a WsAdapter gateway
- Affected
- >= 12.0.0, < 12.5.0; < 11.2.10
- Patched in
- 12.5.0; 11.2.10
- highGHSA-jgpx-8x6j-fcpfNov 12, 2026Process crash via many files validated at once by ParseFilePipe
- Affected
- >= 12.0.0, < 12.5.0; >= 9.3.10, < 11.2.10
- Patched in
- 12.5.0; 11.2.10
- highGHSA-c8fr-c7pf-58pfNov 12, 2026Process crash via a multipart request with many fields on the Express and Node adapters
- Affected
- >= 12.0.0, < 12.5.0; < 11.2.10; >= 12.3.0, < 12.5.0
- Patched in
- 12.5.0; 11.2.10
- highGHSA-c987-fv5x-hmpgNov 12, 2026Path-scoped middleware bypass on Fastify via an empty route parameter
- Affected
- >= 12.0.0, < 12.1.3; < 11.2.8
- Patched in
- 12.1.3; 11.2.8
- highGHSA-fvjq-6m4v-mw3mNov 12, 2026Path-scoped middleware bypass on Fastify via absolute-form request targets with a query before the path
- Affected
- >= 12.0.0, < 12.4.1; < 11.2.9
- Patched in
- 12.4.1; 11.2.9
- mediumGHSA-96h4-vgxj-gvm2Sep 15, 2026Unbounded memory growth in the NestJS TCP microservice transport
- Affected
- < 12.0.3 || < 11.2.5
- Patched in
- 12.0.3, 11.2.5
- highGHSA-9c5c-9qcx-q35qSep 15, 2026Path-scoped middleware bypass via absolute-form request targets
- Affected
- >= 12.0.0 < 12.0.2 and < 11.2.4
- Patched in
- 12.0.2 and 11.2.4
- highCVE-2026-102281Sep 15, 2026Remote process termination via a deeply nested microservice message pattern
- Affected
- >= 12.0.0, < 12.0.2 and < 11.2.4
- Patched in
- 12.0.2 and 11.2.4
- highCVE-2026-54281Jun 8, 2026Middleware Bypass on Fastify via Trailing Slash
- Affected
- <= 11.1.23
- Patched in
- 11.1.24
- highCVE-2026-40879Apr 13, 2026DoS via Recursive handleData in JsonSocket (TCP Transport)
- Affected
- <= 11.1.18
- Patched in
- 11.1.19
- mediumCVE-2026-35515Apr 3, 2026Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in @nestjs/core
- Affected
- =< 11.1.17
- Patched in
- 11.1.18
- highCVE-2026-33011Mar 16, 2026Fastify HEAD Request Middleware Bypass
- Affected
- <= 11.1.15
- Patched in
- 11.1.16
- highCVE-2026-2293Feb 28, 2026Fastify URL Encoding Middleware Bypass
- Affected
- <= 11.1.13
- Patched in
- 11.1.14
- highCVE-2025-69211Dec 29, 2025Fastify URL Encoding Middleware Bypass (TOCTOU)
- Affected
- < 11.1.10
- Patched in
- 11.1.11
- criticalCVE-2025-54782Aug 1, 2025@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers
- Affected
- <=0.2.0
- Patched in
- 0.2.1