NestJS

NestJS now exposes tunable limits for SSE buffering, WebSocket concurrency, Kafka message size, TCP drain timeout, validation error output, and file upload field counts, letting teams cap or lift resource usage per adapter. This release also changes defaults and matching behavior: ValidationPipe's validationError.target now defaults to false, FileTypeValidator matching is stricter (exact suffix match), and MiddlewareConsumer.exclude() route matching depends on the adapter implementing getRouteMatchingOptions(), so teams must update @nestjs/core together with @nestjs/platform-express or @nestjs/platform-fastify and explicitly set validationError.target:true or switch to RegExp file type checks to retain prior behavior.

Matters for: Teams running NestJS microservices over Kafka, MQTT, TCP, or gRPC, and those handling file uploads or route exclusions on platform-express or platform-fastify in production.

NestJS updated the @nestjs/platform-express dependency multer to v2.4.0 to fix CVE-2026-88932, and also backported a fix so multer errors are mapped by error code instead of message.

Matters for: Teams running NestJS applications with Express and multer-based file upload handling that need the correct HTTP status codes and the security patch.

NestJS now provides adapter-agnostic cookie handling, built-in CSRF protection with security headers, and file upload interceptors backed by @fastify/multipart, none of which were built into the framework before. It also adds support for an array of global prefixes instead of a single prefix string.

Matters for: Teams building APIs on the Fastify adapter that need CSRF defenses, security headers, and multipart file uploads without adding separate middleware packages.

NestJS 12 lets you use Standard Schema libraries like Zod, Valibot, and ArkType for route validation and response serialization via new pipes and interceptors, adds a native observability SDK (@nestjs/observe) that instruments controllers, providers, resolvers, and queue consumers without a collector, and ships ESM-ready core packages alongside a rebuilt Vitest-based CLI with an automated nest upgrade command. It requires Node.js v20.19+ or v22.12+ since ESM packages depend on require(esm), and existing CommonJS apps keep working while Joi-based @nestjs/config validation needs Joi v18+ with library-specific options moved under validationOptions.libraryOptions.

Matters for: Teams running existing CommonJS NestJS applications on older Node.js versions who rely on Joi-based config validation or class-validator DTOs.