@nestjs/microservices
12.2.0 · 19 Oct 2026MIT1.2M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @nestjs/microservices. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 12.2.0 | Safe from 12.0.3 | |
| 11.2.7 | Safe from 11.2.5 | |
| 10.4.22 | 3 open advisories, worst high | |
| 9.4.3 | 24 open advisories, worst high · last release Jun 2023, no longer updated |
- HighNest: Remote process termination via a deeply nested microservice message patternGHSA-m8vh-jmq9-5rjg · 29 Sep 2026
- 12.x12.0.0 – 12.0.1Fixed in 12.0.2
- 11.x11.0.0 – 11.2.3Fixed in 11.2.4
- 10.x10.0.0 – 10.4.22No fix on 10.x · move to 11.2.4
- 9.x and older2.0.0 – 9.4.3No fix, no longer updated · move to 11.2.4
- HighNest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)GHSA-hpwf-8g29-85qm · 14 Apr 2026
- 11.x11.0.0 – 11.1.18Fixed in 11.1.19
- 10.x10.0.0 – 10.4.22No fix on 10.x · move to 11.1.19
- 9.x and older2.0.0 – 9.4.3No fix, no longer updated · move to 11.1.19
- ModerateNest: Unbounded memory growth in the NestJS TCP microservice transportGHSA-96h4-vgxj-gvm2 · 30 Sep 2026
- 12.x12.0.0 – 12.0.2Fixed in 12.0.3
- 11.x11.0.0 – 11.2.4Fixed in 11.2.5
- 10.x10.0.0 – 10.4.22No fix on 10.x · move to 11.2.5
- 9.x and older2.0.0 – 9.4.3No fix, no longer updated · move to 11.2.5
Registry facts last checked 22 Oct 2026. Releases and advisories last read 22 Oct 2026.