Update dependency @nestjs/microservices to v11 [SECURITY] by renovate[bot] · Pull Request #919 · nordeck/matrix-meetings

renovate · 2026-04-14T02:08:52Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@nestjs/microservices (source)	`^10.4.22` → `^11.0.0`

Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)

CVE-2026-40879 / GHSA-hpwf-8g29-85qm

More information

Details

Impact

Attacker sends many small, valid JSON messages in one TCP frame
→ handleData() recurses once per message; buffer shrinks each call
→ maxBufferSize is never reached; call stack overflows instead
→ A ~47 KB payload is sufficient to trigger RangeError

Patches

Fixed in @nestjs/microservices@11.1.19

References

Discovered by https://github.com/hwpark6804-gif

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)

CVE-2026-40879 / GHSA-hpwf-8g29-85qm

More information

Details

Impact

Attacker sends many small, valid JSON messages in one TCP frame
→ handleData() recurses once per message; buffer shrinks each call
→ maxBufferSize is never reached; call stack overflows instead
→ A ~47 KB payload is sufficient to trigger RangeError

Patches

Fixed in @nestjs/microservices@11.1.19

References

Discovered by https://github.com/hwpark6804-gif

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

nestjs/nest (@nestjs/microservices)

`v11.1.19`

Compare Source

v11.1.19 (2026-04-13)

Bug fixes

microservices
- #16762 fix(microservices): use backing field for consumer CRASH event listener (@burhanharoon)
- #16764 fix(microservices): prevent stack overflow in jsonsocket.handledata() (@kamilmysliwiec)

Committers: 2

Burhan Haroon⚡ (@burhanharoon)
Kamil Mysliwiec (@kamilmysliwiec)

`v11.1.18`

Compare Source

v11.1.18 (2026-04-03)

Bug fixes

microservices
- #16675 fix(microservices): preserve packet headers in nats serializer (@wwenrr)
core
- #16683 fix(core): prevent injector hang when design:paramtypes is missing (@Youmoo)
- #16637 fix(core): dependency injection edge case with moduleref.create (@JakobStaudinger)
- #16686 fix(core): sanitize sse message

Dependencies

core, platform-express, platform-fastify
- #16679 fix(deps): update dependency path-to-regexp to v8.4.2 (@renovate[bot])
platform-fastify
- #16623 fix(deps): update dependency fastify to v5.8.4 (@renovate[bot])
platform-ws
- #16618 chore(deps): bump ws from 8.19.0 to 8.20.0 (@dependabot[bot])
common
- #16619 chore(deps): bump file-type from 21.3.3 to 21.3.4 (@dependabot[bot])

Committers: 6

Ankit San (@ankitbelal)
Jakob Staudinger (@JakobStaudinger)
Kamil Mysliwiec (@kamilmysliwiec)
Krishna Chaitanya (@Krishnachaitanyakc)
MK (@wwenrr)
youmoo (@Youmoo)

`v11.1.17`

Compare Source

v11.1.17 (2026-03-16)

Enhancements

microservices
- #16218 feat(microservices): add redis driver identification (@vchomakov)

Bugs

platform-fastify
- auto-run middleware for HEAD requests as fastify redirects them to GET handlers (effectively skipping middleware execution) cbdf737 (@kamilmysliwiec)

Dependencies

common
- #16567 fix(deps): update dependency file-type to v21.3.2 (@renovate[bot])
platform-fastify
- #16533 fix(deps): update dependency fastify to v5.8.2 (@renovate[bot])

Committers: 3

Rohan Santhosh Kumar (@Rohan5commit)
Vasil Chomakov (@vchomakov)
Kamil Mysliwiec (@kamilmysliwiec)

`v11.1.16`

Compare Source

v11.1.16 (2026-03-05)

Bug fixes

microservices
- #16506 fix(microservices): fix double callback when isdisposed or err is truthy (@LhonRafaat)

Dependencies

platform-express
- #16507 fix(deps): update dependency multer to v2.1.1 (@renovate[bot])

Committers: 2

Lhon (@LhonRafaat)
Shahnoor Mujawar (@shahnoormujawar)

`v11.1.15`

Compare Source

What's Changed

fix(microservices): if indexOf return 0 will if will be falsy by @cuiweixie in #16401
fix(microservices): introuduce max pattern depth and object complexity by @kamilmysliwiec in #16402
chore(@nestjs/core): allow override for initializeWildcardHandlersIfE… by @StNekroman in #16468
chore(deps): update dependency @fastify/middie to v9.2.0 [security] by @renovate[bot] in #16472
fix(deps): update dependency multer to v2.1.0 [security] by @renovate[bot] in #16474

New Contributors

@cuiweixie made their first contribution in #16401
@StNekroman made their first contribution in #16468

Full Changelog: nestjs/nest@v11.1.14...v11.1.15

`v11.1.14`

Compare Source

v11.1.14 (2026-02-17)

Bug fixes

platform-fastify
- #16384 fix(fastify): fastify middleware bypass cve (@kamilmysliwiec)
common
- #16307 fix: logger print invalid context when no stack trace provided (@JulienDuf)

Enhancements

common
- #16314 fix(common): change requestOrigin type (@SpencerKaiser)

Committers: 5

Julien Dufresne (@JulienDuf)
Kamil Mysliwiec (@kamilmysliwiec)
Mykhailo Skrypsky (@mixator)
Spencer Kaiser (@SpencerKaiser)
조수민 (@suuuuuuminnnnnn)

`v11.1.13`

Compare Source

v11.1.13 (2026-02-03)

Bug fixes

common
- #16230 fix(common): Fix skipping maxArrayLength and maxStringLength option (@chojs23)

Enhancements

microservices
- #16286 feat(microservices): support per-handler qos in mqtt (@suuuuuuminnnnnn)
- #16262 Feat/microservices configurable max buffer size (@jobnow)
common
- #16202 fix(common): exclude built-in primitives from strip proto keys (@som14062005)

Dependencies

platform-fastify
- #16282 fix(deps): update dependency fastify to v5.7.4 (@renovate[bot])
platform-express
- #16241 fix(deps): update dependency cors to v2.8.6 (@renovate[bot])

Committers: 6

Lee Donghyun (@devizi0)
Mykhailo Skrypsky (@mixator)
Neo (@chojs23)
Praveen Somasundaram (@som14062005)
Ricardo Gomes (@jobnow)
조수민 (@suuuuuuminnnnnn)

`v11.1.12`

Compare Source

v11.1.12 (2026-01-15)

Bug fixes

common
- #16187 fix(common): regression in loading file-type under Windows OS (@iamkanguk97)

Dependencies

platform-ws
- #16161 chore(deps): bump ws from 8.18.3 to 8.19.0 (@dependabot[bot])
common
- #16155 fix(deps): update dependency file-type to v21.3.0 (@renovate[bot])
platform-fastify
- #16154 fix(deps): update dependency find-my-way to v9.4.0 (@renovate[bot])

Committers: 3

Antonio Tripodi (@Tony133)
KANGUK LEE (@iamkanguk97)
@miso-kyoungminkim

`v11.1.11`

Compare Source

v11.1.11 (2025-12-29)

Bug fixes

platform-fastify
- #16135 fix(platform-fastify): middie bypassing through decoded chars (@kamilmysliwiec)
core
- #16133 fix(core): add missing catch handler for forward-ref provider resolution (@coti-z)

Dependencies

platform-socket.io
- #16125 fix(deps): update dependency socket.io to v4.8.3 (@renovate[bot])
- #16114 chore(deps): bump socket.io from 4.8.1 to 4.8.2 (@dependabot[bot])
platform-fastify
- #16130 fix(deps): update dependency @fastify/static to v9 (@renovate[bot])
common
- #16127 chore(deps): bump file-type from 21.1.1 to 21.2.0 (@dependabot[bot])

Committers: 3

Himanshu Gupta (@manureja64)
Kamil Mysliwiec (@kamilmysliwiec)
coti (@coti-z)

`v11.1.10`

Compare Source

v11.1.10 (2025-12-22)

Bug fixes

core
- #16098 fix(core): instantiate nested transient providers in static context (@mag123c)
- #16005 fix(core): resolve all providers when using resolve() with each option (@malkovitc)
microservices
- #16072 fix(microservices): fix grpc stream method return type (@shash-hq)
common
- #16077 fix(common): resolve file-type path explicitly (@shash-hq)
- #16013 fix(common): Support fallbackToMimetype without buffer (@chenjieya)

Enhancements

common
- #16100 fix(common): improve error handling in FileTypeValidator (@malkovitc)
- #16060 feat(common): add message property to file type validator (@Jo-Minseok)
- #16079 fix: enhance ValidationPipe (@liu-jin-yi)
core
- #15721 feat(core): add Promise support for SSE handlers (@pythonjsgo)
microservices
- #15975 feat(microservices): add keepalive support for server side (@OlegStrokan)
common, core
- #15986 feat(core): add option for async logger compatibility (@mag123c)

Dependencies

platform-fastify
- #16041 fix(deps): update dependency @fastify/cors to v11.2.0 (@renovate[bot])
platform-express
- #16002 fix(deps): update dependency express to v5.2.1 (@renovate[bot])
common
- #15948 chore(deps): bump file-type from 21.1.0 to 21.1.1 (@dependabot[bot])

Committers: 11

Alexander (@pythonjsgo)
J_Coder (@Jo-Minseok)
Luke Son (@KAPUIST)
Oleh Strokan (@OlegStrokan)
Praveen Somasundaram (@som14062005)
Shashank (@shash-hq)
@chenjieya
@giorgikakauridze
@mag123c
chernomortsev evgeny (@malkovitc)
liu-jin-yi (@liu-jin-yi)

`v11.1.9`

Compare Source

v11.1.9 (2025-11-14)

Bug fixes

core
- #15865 fix(core): make get() throw for implicitly request-scoped trees (@JoeNutt)

Enhancements

common
- #15863 feat(common): add method options to @sse decorator (@TomerSteinberg)

Dependencies

platform-fastify
- #15899 chore(deps): bump fastify from 5.6.1 to 5.6.2 (@dependabot[bot])

Committers: 4

Rami (@JoeNutt)
Rhynel Algopera (@dev-rhynel)
Tomer Steinberg (@TomerSteinberg)
WuMingDao (@WuMingDao)

`v11.1.8`

Compare Source

v11.1.8 (2025-10-27)

Bug fixes

core
- #15815 fix(core): ensure nested transient provider isolation (@mag123c)
platform-fastify
- #15831 fix(fastify): Migrate fastify top-level options to routerOptions (@kim-sung-jee)

Committers: 2

JaeHo Jang (@mag123c)
Seongjee Kim (@kim-sung-jee)

`v11.1.7`

Compare Source

v11.1.7 (2025-10-21)

Bug fixes

microservices
- #15747 Fix/rmq microservice fanout bind (@slon2015)
platform-fastify
- #15732 fix: correct parameter type in RouteConstraints decorator (@thedv91)
core
- #15571 fix(core): skip lifecycle hooks for non-instantiated transient services (@mag123c)
common
- #15577 Add color allowance check to console logger options (@kerryChen95)

Enhancements

common, platform-socket.io, websockets
- #15543 feat(websockets): allow manual acknowledgement handling with @Ack() decorator (@kim-sung-jee)
common
- #15705 fix(core): resolve extras in configurable module builder async methods (@mag123c)
common, core
- #15503 feat(common): add force-console option to console logger (@mag123c)
core
- #15588 fix(core): improve dependency resolution error messages (@at7211)
microservices
- #15598 feat(errors): add InvalidTcpDataReceptionException for handling TCP receive errors (@ghyghoo8)

Dependencies

platform-fastify
- #15664 chore(deps): bump fastify to 5.6.1 (@dependabot[bot])
core, platform-express, platform-fastify
- #15622 fix(deps): update dependency path-to-regexp to v8.3.0 (@renovate[bot])
common
- #15566 chore(deps): bump load-esm from 1.0.2 to 1.0.3 (@dependabot[bot])

Committers: 9

Harry (@thedv91)
JaeHo Jang (@mag123c)
Jay-Chou (@at7211)
Kerry (@kerryChen95)
Micael Levi L. Cavalcante (@micalevisk)
Seongjee Kim (@kim-sung-jee)
SerafimGerasimov (@slon2015)
@Olexandr88
ghy (@ghyghoo8)

`v11.1.6`

Compare Source

v11.1.6 (2025-08-07)

Bug fixes

core
- #15504 fix(core): fix race condition in class dependency resolution from imported modules (@hajekjiri)
- #15469 fix(core): attach root inquirer for nested transient providers (@kamilmysliwiec)
microservices
- #15508 fix(microservices): report correct buffer length in exception (@kim-sung-jee)
- #15492 fix(microservices): fix kafka serilization of class instances (@LeonBiersch)

Dependencies

platform-fastify
- #15493 chore(deps): bump @fastify/cors from 11.0.1 to 11.1.0 (@dependabot[bot])

Committers: 6

Jiri Hajek (@hajekjiri)
Kamil Mysliwiec (@kamilmysliwiec)
Leon Biersch (@LeonBiersch)
Seongjee Kim (@kim-sung-jee)
@premierbell
pTr (@ptrgits)

`v11.1.5`

Compare Source

v11.1.5 (2025-07-18)

Dependencies

platform-express
- #15425 chore(deps): bump multer from 2.0.1 to 2.0.2 in /packages/platform-express (@dependabot[bot])

`v11.1.4`

Compare Source

v11.1.4 (2025-07-16)

Bug fixes

platform-fastify
- #15385 fix(testing): auto-init fastify adapter for middleware registration (@mag123c)
core, testing
- #15405 fix(core): fix race condition in class dependency resolution (@hajekjiri)
core
- #15333 fix(core): Make flattenRoutePath return a valid module (@gentunian)
microservices
- #15305 fix(microservices): Revisit RMQ pattern matching with wildcards (@getlarge)
- #15250 fix(constants): update RMQ_DEFAULT_QUEUE to an empty string (@EeeasyCode)

Enhancements

platform-fastify
- #14789 feat(fastify): add decorator for custom schema (@piotrfrankowski)
common, core, microservices, platform-express, platform-fastify, websockets
- #15386 feat: enhance introspection capabilities (@kamilmysliwiec)
core
- #15374 feat: supporting fine async storage control (@Farenheith)

Dependencies

platform-ws
- #15350 chore(deps): bump ws from 8.18.2 to 8.18.3 (@dependabot[bot])
platform-fastify
- #15278 chore(deps): bump fastify from 5.3.3 to 5.4.0 (@dependabot[bot])

Committers: 11

Alexey Filippov (@SocketSomeone)
EFIcats (@ext4cats)
Edouard Maleix (@getlarge)
JaeHo Jang (@mag123c)
Jiri Hajek (@hajekjiri)
Kamil Mysliwiec (@kamilmysliwiec)
Khan / 이창민 (@EeeasyCode)
Peter F. (@piotrfrankowski)
Sebastian (@gentunian)
Thiago Oliveira Santos (@Farenheith)
jochong (@jochongs)

`v11.1.3`

Compare Source

v11.1.3 (2025-06-06)

Bug fixes

core
- #15201 fix(core): gracefully shutdown the app when repl exits (@dzhlobo)

Enhancements

common
- #15209 feat: add string array type to disposition (@fjodor-rybakov)
common, core
- #15203 feat(core): defer initialization connected microservice (@isaryy)

Dependencies

platform-express
- #15232 chore(deps): bump multer from 2.0.0 to 2.0.1 (@dependabot[bot])

Committers: 3

Dmitry Zhlobo (@dzhlobo)
@fjodor-rybakov
@isaryy

`v11.1.2`

Compare Source

v11.1.2 (2025-05-26)

Bug fixes

microservices
- #15172 fix(microservices): support custom strategy in async usefactory config (@mag123c)
- #15166 fix(microservice): prevent error logs during redis client shutdown (@janroker)

Dependencies

common
- #15185 chore(deps): bump file-type from 20.5.0 to 21.0.0 (@dependabot[bot])
platform-express
- #15159 chore(deps): bump multer from 1.4.5-lts.2 to 2.0.0 (@dependabot[bot])

Committers: 2

JaeHo Jang (@mag123c)
Jan Roček (@janroker)

`v11.1.1`

Compare Source

v11.1.1 (2025-05-14)

Bug fixes

core
- #15056 fix(core): HTTP adapter error mapping (@maxbronnikov10)
microservices
- #15062 fix(microservices): ensure all redis and amqp client closes properly (@yatin166)
- #15032 fix(microservices): ensure all the amqp connections are closed properly (@yatin166)
- #15020 fix(microservices): ensure all redis connections are closed (@yatin166)
core, platform-fastify
- #15061 fix(core): bring back getHeader and appendHeader methods from AbstractHttpAdapter (@micalevisk)
platform-express
- #15010 feat: remove use of pipeline (@jmcdo29)

Enhancements

microservices
- #14606 feat(microservices): add specific transport id to microservices (@maxbronnikov10)
- #15057 feat(microservices): Allow custom exchangeType as string for plugin compatibility (@ChangmoKang)
- #15072 feat(microservices): Add exchange arguments to RabbitMQ (@gapon2401)

Dependencies

platform-fastify
- #15129 chore(deps): bump fastify from 5.3.2 to 5.3.3 (@dependabot[bot])
platform-ws
- #15068 chore(deps): bump ws from 8.18.1 to 8.18.2 (@dependabot[bot])
common
- #15029 chore(deps): bump file-type from 20.4.1 to 20.5.0 (@dependabot[bot])

Committers: 7

Antonio Tripodi (@Tony133)
Changmo Kang (Ryan) (@ChangmoKang)
Igor Gaponov (@gapon2401)
Jackie McDoniel (@jmcdo29)
Maxim Bronnikov (@maxbronnikov10)
Micael Levi L. Cavalcante (@micalevisk)
Yatin Gaikwad (@yatin166)

`v11.1.0`

Compare Source

v11.1.0 (2025-04-23)

Enhancements

microservices
- #14540 feat(microservices): add support for topic exchange (rabbitmq) (@kamilmysliwiec)

Committers: 1

Kamil Mysliwiec (@kamilmysliwiec)

`v11.0.21`

Compare Source

v11.0.21 (2025-04-23)

Enhancements

common
- #14995 feat(common): Add fallbackToMimetype support in FileTypeValidator (@mag123c)

Dependencies

platform-fastify
- #14989 fix(deps): update dependency fastify to v5.3.2 [security] (@renovate[bot])

Committers: 1

JaeHo Jang (@mag123c)

`v11.0.20`

Compare Source

What's Changed

refactor(common): Prevent JavaScript being wrapped in eval by @Borewit in #14974

New Contributors

@Borewit made their first contribution in #14974

Full Changelog: nestjs/nest@v11.0.19...v11.0.20

`v11.0.19`

Compare Source

`v11.0.18`

Compare Source

What's Changed

chore(common): temporarily move file-type to regular deps d9a69a3

Full Changelog: nestjs/nest@v11.0.17...v11.0.18

`v11.0.17`

Compare Source

`v11.0.16`

Compare Source

v11.0.16 (2025-04-11)

fix(common): use file-type to validate file mimetypes by @Chathula in #14881

`v11.0.15`

Compare Source

v11.0.15 (2025-04-10)

Bug fixes

platform-fastify
- #14935 fix(fastify): methods comparison (@johaven)

Committers: 1

Johan Legrand (@johaven)

`v11.0.14`

Compare Source

v11.0.14 (2025-04-09)

Bug fixes

platform-fastify
- #14511 fix(fastify): adds the non-standard http methods to the instance (@johaven)

Committers: 1

Johan Legrand (@johaven)

`v11.0.13`

Compare Source

v11.0.13 (2025-04-03)

Bug fixes

platform-fastify
- #14895 fix(fastify-adapter): global prefix exclusion path handling w/middleware (@KyleLilly)
microservices
- #14869 fix(microservices): do not re-create client connection once get client by service name (@mingo023)

Dependencies

platform-express
- #14883 fix(deps): update dependency express to v5.1.0 (@renovate[bot])
- #14817 fix(deps): update dependency multer to v1.4.5-lts.2 (@renovate[bot])
platform-fastify
- #14861 fix(deps): update dependency fastify to v5.2.2 (@renovate[bot])
- #14864 chore(deps): bump @fastify/cors from 11.0.0 to 11.0.1 (@dependabot[bot])

Committers: 2

Kyle Lilly (@KyleLilly)
Minh Ngo (@mingo023)

`v11.0.12`

Compare Source

v11.0.12 (2025-03-19)

Bug fixes

core
- #14803 fix(core): infinite loop on broken circular reference (@kamilmysliwiec)
- #14792 dependencies not resolving for request-scoped lazy providers (@anizozina)

Enhancements

core
- #14802 feat(core): add options to the legacy route converter (@kamilmysliwiec)

`v11.0.11`

Compare Source

v11.0.11 (2025-02-28)

Enhancements

platform-fastify
- #14677 perf: Switch deprecated parser querystring for fast-querystring (@smith558)

Dependencies

platform-fastify
- #14711 fix(deps): update dependency @fastify/cors to v11 (@renovate[bot])
platform-ws
- #14689 chore(deps): bump ws from 8.18.0 to 8.18.1 (@dependabot[bot])

Committers: 1

Stanislav (Stanley) Modrak (@smith558)

`v11.0.10`

Compare Source

v11.0.10 (2025-02-17)

Bug fixes

microservices
- #14605 fix(microservices): server send drops emitted value (@shprota)
platform-express
- #14640 fix(platform-express) respect custom parser middlewares in Express 5 (@luddwichr)

`v11.0.9`

Compare Source

v11.0.9 (2025-02-10)

Bug fixes

core
- #14597 perf(core): use topology tree for calculating distance (depth) (@kamilmysliwiec)
common
- #14579 fix(common): revert to original value (swc builders regression) (@kamilmysliwiec)

Committers: 2

Kamil Mysliwiec (@kamilmysliwiec)

`v11.0.8`

Compare Source

v11.0.8 (2025-02-06)

Bug fixes

common
- #14546 fix(common): addLeadingSlash optional group support (@dcharbonnier)
platform-express
- #14574 fix(platform-express) make check for existing middlewares work with Express 5 (@luddwichr)

Committers: 4

Ghassen Rjab (@GhassenRjab)
Shay Molcho (@shaymolcho)
@dcharbonnier
@luddwichr

`v11.0.7`

Compare Source

v11.0.7 (2025-01-31)

Bug fixes

core
- #14523 fix: middleware sort issues (@rbnayax)

Committers: 1

@rbnayax

`v11.0.6`

Compare Source

v11.0.6 (2025-01-27)

Bug fixes

core
- #14522 fix(core): allow optional named wildcard groups (@kamilmysliwiec)

Committers: 1

Kamil Mysliwiec (@kamilmysliwiec)

`v11.0.5`

Compare Source

v11.0.5 (2025-01-23)

Bug fixes

core
- #14495 fix(core): global module middleware should be executed first (@kamilmysliwiec)

Committers: 1

Kamil Mysliwiec (@kamilmysliwiec)

⚠️ Node v16 and v18 are no longer supported (>= v20 is required).

Features

common, core, microservices
- #14142 feat(microservices): add status, unwrap, on methods to microservice transporters (clients/servers) (@kamilmysliwiec)
- #14121 feat(common): add json logger, built-in logger improvements (@kamilmysliwiec)
common, core
- #13336 feat(core): introduce different module opaque key factories (improve bootstrap performance) (@kamilmysliwiec)
common, core, microservices, platform-express, platform-fastify, platform-socket.io, platform-ws, testing, websockets
- #14238 chore(deps): upgrade to express v5, fastify v5, add legacy route path converter to minimize breaking changes (@kamilmysliwiec)

Enhancements

common
- #14213 feat(common): add error messages for file validators (@mag123c)
- #14131 feat(common): allow passing number to http error createBody (@kamilmysliwiec)
- #14122 feat(common): add ParseDatePipe, add tsdoc to other pipes (@kamilmysliwiec)
- #12735 feat(common)!: type narrowing allowed injection tokens for @Inject() (@micalevisk)
- #12764 fix(common): apply options to plaintoclass in classserializerinterceptor (@kmw14641)
- #14126 fix(common): type narrowing context parameter on createParamDecorator's callback (@EeeasyCode)
- #13628 chore(class-transformer): plainToClass is deprectated and replaced with plainToInstance (@tomflorentin)
microservices
- #14200 feat(microservices): support nats queue per handler (@kamilmysliwiec)
- #13924 feat(microservices): add gracefull shutdown option for nats server (@alinowrouzii)
- #12622 feat: allow for microservice options to come from the di container (@jmcdo29)
- #14134 feat(microservices): add max tcp packet buffer length (@kamilmysliwiec)
- #12761 feat(microservices): ability to use a random port for the TCP server (@PieterScheffers)
websockets
- #14184 feat(websockets): include exception cause to associate error with req (@kamilmysliwiec)
common, core, microservices, websockets
- #14182 feat(common): introduce intrinsic exception (@kamilmysliwiec)
common, core, platform-fastify
- #13278 feat(core,common,platform-fastify): add webdav http methods support (@johaven)
platform-express
- #13407 feat: add multer error fieldname to the exception message (@mmgroner)
platform-ws
- #14127 feat(ws): introduce message parser for ws adapter (@CodyTseng)
platform-fastify
- #14115 chore(fastify): update fastify view options interface (@Tony133)
- #14116 refactor(fastify): update fastify static options interface (@Tony133)
common, core
- #14113 feat(core): allow overriding abortOnError for the select method (@kamilmysliwiec)

Bug fixes

core
- #14267 fix shutdown hooks order (@flovouin)
- #13388 correction of Reflector types (@AlexRMU)
- #14110 fix(core): Calculate module distance after bindGlobalScope (@wenlong-chen)
- #14111 fix(core): Order of module destroy should be the reverse of module init (@wenlong-chen)
- [#14097](https://redirect.github.com/nestjs/nest/pull/14097

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- At any time (no schedule defined)
Automerge
- Monday through Friday (* * * * 1-5)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

changeset-bot · 2026-04-14T02:08:56Z

⚠️ No Changeset found

Latest commit: d829018

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

renovate Bot added Major NestJS Prod Security labels Apr 14, 2026

renovate Bot requested a review from a team as a code owner April 14, 2026 02:08

renovate Bot added NestJS Prod Security Major labels Apr 14, 2026

renovate Bot force-pushed the renovate/npm-nestjs-microservices-vulnerability branch 2 times, most recently from 4afb2c6 to e49b13b Compare April 23, 2026 16:53

renovate Bot force-pushed the renovate/npm-nestjs-microservices-vulnerability branch 3 times, most recently from 1a767ac to 8b24f3f Compare April 27, 2026 08:41

renovate Bot force-pushed the renovate/npm-nestjs-microservices-vulnerability branch 2 times, most recently from ba7d2f6 to 341d0f3 Compare May 18, 2026 19:13

renovate Bot force-pushed the renovate/npm-nestjs-microservices-vulnerability branch from 341d0f3 to a3bb092 Compare May 30, 2026 20:17

renovate Bot force-pushed the renovate/npm-nestjs-microservices-vulnerability branch 4 times, most recently from a92ccf0 to 3b9ca89 Compare June 17, 2026 09:05

renovate Bot force-pushed the renovate/npm-nestjs-microservices-vulnerability branch 3 times, most recently from ebc8ffb to df5fdd8 Compare June 29, 2026 15:05

renovate Bot force-pushed the renovate/npm-nestjs-microservices-vulnerability branch 5 times, most recently from 5c31b57 to 03a639f Compare July 13, 2026 15:39

renovate Bot force-pushed the renovate/npm-nestjs-microservices-vulnerability branch 5 times, most recently from bf93206 to 4374dcc Compare July 21, 2026 10:53

renovate Bot force-pushed the renovate/npm-nestjs-microservices-vulnerability branch 5 times, most recently from 303d54a to 0ab6e43 Compare July 28, 2026 16:00

Update dependency @nestjs/microservices to v11 [SECURITY]

d829018

renovate Bot force-pushed the renovate/npm-nestjs-microservices-vulnerability branch from 0ab6e43 to d829018 Compare July 28, 2026 19:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update dependency @nestjs/microservices to v11 [SECURITY] - #919

Update dependency @nestjs/microservices to v11 [SECURITY]#919
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-nestjs-microservices-vulnerability

renovate Bot commented Apr 14, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Apr 14, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)

Details

Impact

Patches

References

Severity

References

Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)

Details

Impact

Patches

References

Severity

References

Release Notes

v11.1.19 (2026-04-13)

Bug fixes

Committers: 2

v11.1.18 (2026-04-03)

Bug fixes

Dependencies

Committers: 6

v11.1.17 (2026-03-16)

Enhancements

Bugs

Dependencies

Committers: 3

v11.1.16 (2026-03-05)

Bug fixes

Dependencies

Committers: 2

What's Changed

New Contributors

v11.1.14 (2026-02-17)

Bug fixes

Enhancements

Committers: 5

v11.1.13 (2026-02-03)

Bug fixes

Enhancements

Dependencies

Committers: 6

v11.1.12 (2026-01-15)

Bug fixes

Dependencies

Committers: 3

v11.1.11 (2025-12-29)

Bug fixes

Dependencies

Committers: 3

v11.1.10 (2025-12-22)

Bug fixes

Enhancements

Dependencies

Committers: 11

v11.1.9 (2025-11-14)

Bug fixes

Enhancements

Dependencies

Committers: 4

v11.1.8 (2025-10-27)

Bug fixes

Committers: 2

v11.1.7 (2025-10-21)

Bug fixes

Enhancements

Dependencies

Committers: 9

v11.1.6 (2025-08-07)

Bug fixes

Dependencies

Committers: 6

v11.1.5 (2025-07-18)

Dependencies

v11.1.4 (2025-07-16)

Bug fixes

renovate Bot commented Apr 14, 2026 •

edited

Loading