Backend framework
NestJS: latest release and open vulnerabilities today
The latest release of the @nestjs/core package is 12.1.3. No high or critical advisories for the @nestjs/core package were published in the last 12 months (1 lower-severity); none of its advisories is on CISA’s list of exploited vulnerabilities.
- Latest @nestjs/core release
- 12.1.3
- npm downloads last week
- 16.4M
- GitHub stars
- 76.9k
- Licence
- MIT
- OpenSSF Scorecard
- 6.8 / 10
Security advisories
1 advisory published in the last 12 months. 2 in total since records began. Checked packages: @nestjs/core.
Maintenance and supply chain
OpenSSF Scorecard 6.8 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 24 issue updates found in the last 90 days.
Weakest checks
- Little code review (Code-Review 0/10)
- Unpinned build dependencies (Pinned-Dependencies 0/10)
- No fuzzing (Fuzzing 0/10)
Alternatives
Express.js
Minimal Node.js web framework
Strengths
- Lightweight and flexible
- Huge ecosystem
Trade-offs
- Minimal built-in features
- Manual setup required
Django
High-level Python web framework with batteries included
Strengths
- Comprehensive built-in features (ORM, admin, auth)
- Secure by default (CSRF, SQL injection protection)
Trade-offs
- Monolithic and opinionated
- Slower than lightweight frameworks
FastAPI
Modern Python framework for building APIs with type hints
Strengths
- Extremely fast performance (on par with Node/Go)
- Automatic API documentation (OpenAPI/Swagger)
Trade-offs
- Younger ecosystem than Django/Flask
- Less built-in features than Django
Ruby on Rails
Full-stack web framework emphasizing convention over configuration
Strengths
- Convention over configuration (rapid development)
- Rich ecosystem of gems (libraries)
Trade-offs
- Slower runtime performance than competitors
- Monolithic architecture can be restrictive
Docs and release notes
Check NestJS in your own stack
This page checks NestJS in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.