NestJS 12.2 Hardening, Next.js 16.4.2 and Nuxt 4.6.2

Executive Summary

• NestJS 12.2.0 (Oct 19) adds DoS-oriented limits for SSE, WebSockets, Kafka and TCP, and changes ValidationPipe, FileTypeValidator and middleware exclusion behavior. See the release notes.
• Next.js 16.4.2 (Oct 15) backports Turbopack fixes on top of the security-critical 16.4.1. See v16.4.2.
• TanStack Start CVE-2026-102989 is a critical reflected XSS in server-function responses; patched packages are on npm. See the advisory.
• Node.js security releases for 26.x, 24.x and 22.x are scheduled for today (Oct 21), highest severity HIGH. At audit time (06:05 UTC) the latest published build was v26.12.0. See the pre-announcement.
• Also on the registry: Nuxt 4.6.2, Astro 7.4.1, SvelteKit 3.1.0, Motion 14.5.0, Better Auth 1.7.12, Clerk Next.js SDK 7.9.18, Wrangler 4.151.3 and BullMQ 6.3.19.

NestJS 12.2.0: New Limits and Behavior Changes

The 12.2.0 release is mostly hardening. New options cap resource use: @Sse({ maxPendingDataLength }) (4M characters default), maxConcurrentMessages on the Socket.IO and ws adapters (1000), maxErrorMessagesLength on ValidationPipe, Kafka parser.maxMessageSize (16 MiB; larger messages are logged and skipped) and a TCP drainTimeout (30 s). Express and Fastify now default fieldNestingDepth to 32 and fieldArrayIndexLimit to 1000 for uploads.

Behavior changes to test before upgrading:

• ValidationPipe defaults to validationError.target: false, so error.target is undefined inside a custom exceptionFactory, and it returns 400 when an array or primitive is sent for a validated class.
• FileTypeValidator string matching is now exact to the end of the name: font/woff no longer accepts font/woff2.
• Middleware exclude() follows the router's case and trailing-slash matching; update core and platform packages together.
• A global enhancer that fails to instantiate now stops startup, and request- or transient-scoped APP_FILTER providers log a startup warning.

If you relied on prefix-style file type matching, switch to a RegExp:

new ParseFilePipe({
  validators: [
    // exact string matching is now stricter; use a RegExp for prefixes
    new FileTypeValidator({ fileType: /^font\/woff2?$/ }),
  ],
});

Next.js 16.4.2: Turbopack Backports

Next.js v16.4.2 fixes turbo-tasks snapshot consistency, two Turbopack garbage-collection paths that could leave dependency edges partially torn down, chunk-list collisions for lazy dynamic imports, and ignores realpath errors in module resolution to match Node.js. If you are on 16.4.x, this is a safe patch bump, but make sure you are at least on 16.4.1 for the October 14 security fixes (two critical RCEs, one high DoS).

npm install [email protected]
npm ls next sharp   # sharp must resolve to 0.35.5 or later

TanStack Start: Critical Reflected XSS

Per the TanStack advisory, CVE-2026-102989 lets an attacker craft a server-function URL that returns attacker-controlled HTML from your origin; the script then runs with the victim's session. Affected: versions from 1.143.12 up to the patched builds: @tanstack/react-start 1.168.60, solid-start 1.168.57, vue-start 1.168.56 and start-server-core 1.169.39. Upgrade, confirm the lockfile, and redeploy; a local update alone does not protect deployed apps.

npm update @tanstack/react-start @tanstack/start-server-core
npm ls @tanstack/start-server-core   # expect >= 1.169.39

Node.js: Security Releases Due Today

The pre-announcement confirms new 26.x, 24.x and 22.x releases with a highest severity of HIGH. No CVE IDs or version numbers were published when this audit ran, so none are listed here. End-of-life lines are always affected; check the release schedule and rebuild images once patched tags appear.

Nuxt 4.6.2 and Astro 7.4.1

Nuxt 4.6.2 (Oct 16) is a fix-only release of about 30 items: server island head tags follow useHeadSafe rules, server route rules match case-insensitively unless routing is sensitive, error state survives aborted navigation, and dev overlays replay only to newly loaded pages. Astro 7.4.1 (Oct 19) fixes TSCONFIG_ERROR failures when a parent tsconfig cannot be resolved, missing styles for conditionally rendered framework components inside hydrated islands, dev-server memory growth when editing the config, and project paths containing an apostrophe.

Other Registry Activity

Published on npm but not reviewed in detail: SvelteKit 3.1.0 (Oct 14), Motion 14.5.0 (today), Better Auth 1.7.12, Wrangler 4.151.3 and BullMQ 6.3.19 (Oct 20). Read their changelogs before upgrading.

Coverage note: GitHub API access was unavailable, so Docker, Kubernetes, Keycloak, databases, ORMs and queue releases were not verified today and are omitted rather than guessed.