Securitysshole: password bypass in Alpine’s OpenSSH

@nestjs/core@12.4.1

Skip this version — install 12.4.2 instead.

Followed by 12.4.2 within 4 h, faster than this project's usual cadence — likely a hotfix.

Why this verdict

  • Followed by 12.4.2 within 4 h, faster than this project's usual cadence — likely a hotfix.Evidence
  • Published 70 h ago; most regressions surface within 72 h.Evidence

Confidence 100% · algorithm v1 · computed 2026-11-12. How verdicts work

Supply chain and security

Malware reports
None known (OSV)
Known advisories
None known (OSV)
License
MIT
Install scripts
None
Build provenance
No provenance
Weekly downloads
17,931

Compatibility

No compatibility boundary is crossed: this is a patch or minor release on a stable major.

1 issue mentions this version in nestjs/nest so far (14-day window still open). See them on GitHub

Check the official release notes below for behaviour changes before merging.

Release notes

Read the NestJS changelog on Changes.Watch or the package page on npm for this version’s features and fixes.

New in this release

  • The node platform adapter now injects request objects like the Fastify adapter.“* [#18435](https://github.com/nestjs/nest/pull/18435) feat(node): inject requests into the node adapter like the fastify one”
  • The node platform adapter now sets req.route similar to Express.“* [#18439](https://github.com/nestjs/nest/pull/18439) feat(node): set req.route on the node adapter like express does”
  • Core and common now warn when decorator metadata is missing.“* [#18429](https://github.com/nestjs/nest/pull/18429) fix(core,common): warn when decorator metadata is missing”

AI-extracted from the official release notes and checked against the quoted text. Read the source

Deprecations and deadlines

The maintainer has not deprecated this version on npm.

Did upgrading to 12.4.1 work for you?

Results appear once three developers have voted.

More @nestjs/core verdicts