v11.2.6

nestjs/nestv11.2.6Sep 23, 2026by kamilmysliwiec

Upgrading?

AI Summary

This release updates the @nestjs/platform-express package to address a security vulnerability. It also refines error handling logic by mapping multer errors by code, ensuring unexpected file fields return 400 instead of 500.

Key Highlights

  • Security Update: Updated multer dependency to v2.4.0 to address CVE-2026-88932.
  • Error Handling: Changed error mapping to use error codes instead of messages.
  • Status Code Fix: Unexpected file fields now correctly return 400 instead of 500.

Full Release Notes

## What's changed

- `@nestjs/platform-express`
  - [fix(deps): update dependency multer to v2.4.0 [security]](https://github.com/nestjs/nest/commit/fb8ecdbef124f102f96de7f62db70b68296e6ae0) — fixes CVE-2026-88932 ([GHSA-3pph-fpjx-jg34](https://github.com/advisories/GHSA-3pph-fpjx-jg34))
  - [fix(express): map multer errors by code instead of message](https://github.com/nestjs/nest/commit/58c3634b25b027d72fc25ec66d92311cb3d4b249) — backport of #17769; a file sent under an unexpected field name now returns 400 again instead of 500 with multer 2.4.0

**Full Changelog**: https://github.com/nestjs/nest/compare/v11.2.5...v11.2.6

Related Repositories