@nestjs/platform-fastify 12.1.1 → 12.1.3

package/adapters/fastify-adapter.d.ts

@@ -61,7 +61,10 @@ export declare class FastifyAdapter<TServer extends RawServerBase = RawServerDef
     protected _pathPrefix?: string;
     private readonly openConnections;
     private isClosing;
+    private isShuttingDown;
+    private return503OnClosing;
     private _isParserRegistered;
+    private readonly registeredContentTypes;
     private onRequestHook?;
     private onResponseHook?;
     private isMiddieRegistered;
@@ -73,11 +76,13 @@ export declare class FastifyAdapter<TServer extends RawServerBase = RawServerDef
     private readonly versionConstraint;
     get isParserRegistered(): boolean;
     constructor(instanceOrOptions?: TInstance | FastifyHttp2Options<any> | FastifyHttp2SecureOptions<any> | FastifyHttpsOptions<any> | FastifyHttpOptions<any> | FastifyAdapterBaseOptions<TServer>);
+    private runLifecycleHook;
     setOnRequestHook(hook: (request: TRequest, reply: TReply, done: (err?: Error) => void) => void | Promise<void>): void;
     setOnResponseHook(hook: (request: TRequest, reply: TReply, done: (err?: Error) => void) => void | Promise<void>): void;
     init(): Promise<void>;
     listen(port: string | number, callback?: () => void): void;
     listen(port: string | number, hostname: string, callback?: () => void): void;
+    private isValidPort;
     get(...args: any[]): FastifyInstance<TServer, TRawRequest, TRawResponse, FastifyBaseLogger, import("fastify").FastifyTypeProviderDefault>;
     post(...args: any[]): FastifyInstance<TServer, TRawRequest, TRawResponse, FastifyBaseLogger, import("fastify").FastifyTypeProviderDefault>;
     head(...args: any[]): FastifyInstance<TServer, TRawRequest, TRawResponse, FastifyBaseLogger, import("fastify").FastifyTypeProviderDefault>;
@@ -94,10 +99,11 @@ export declare class FastifyAdapter<TServer extends RawServerBase = RawServerDef
     move(...args: any[]): FastifyInstance<TServer, TRawRequest, TRawResponse, FastifyBaseLogger, import("fastify").FastifyTypeProviderDefault>;
     lock(...args: any[]): FastifyInstance<TServer, TRawRequest, TRawResponse, FastifyBaseLogger, import("fastify").FastifyTypeProviderDefault>;
     unlock(...args: any[]): FastifyInstance<TServer, TRawRequest, TRawResponse, FastifyBaseLogger, import("fastify").FastifyTypeProviderDefault>;
+    all(...args: any[]): any;
     applyVersionFilter(handler: Function, version: VersionValue, versioningOptions: VersioningOptions): VersionedRoute<TRequest, TReply>;
     reply(response: TRawResponse | TReply, body: any, statusCode?: number): FastifyReply<RouteGenericInterface, TServer, TRawRequest, TRawResponse, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown>;
     status(response: TRawResponse | TReply, statusCode: number): any;
-    end(response: TReply, message?: string): void;
+    end(response: TRawResponse | TReply, message?: string): void;
     render(response: TReply & {
         view: Function;
     }, view: string, options: any): FastifyReply<RouteGenericInterface, RawServerDefault, http.IncomingMessage, http.ServerResponse<http.IncomingMessage>, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown>;
@@ -120,11 +126,12 @@ export declare class FastifyAdapter<TServer extends RawServerBase = RawServerDef
     useMultipart(): void;
     inject(): LightMyRequestChain;
     inject(opts: InjectOptions | string): Promise<LightMyRequestResponse>;
+    beforeClose(): void;
     close(): Promise<void>;
     initHttpServer(options?: NestApplicationOptions): void;
     useStaticAssets(options: FastifyStaticOptions): any;
     setViewEngine(options: FastifyViewOptions | string): any;
-    isHeadersSent(response: TReply): boolean;
+    isHeadersSent(response: TRawResponse | TReply): boolean;
     getHeader(response: any, name: string): any;
     setHeader(response: TReply, name: string, value: string): FastifyReply<RouteGenericInterface, TServer, TRawRequest, TRawResponse, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown>;
     appendHeader(response: any, name: string, value: string): any;
@@ -163,9 +170,22 @@ export declare class FastifyAdapter<TServer extends RawServerBase = RawServerDef
     private isNativeResponse;
     private registerJsonContentParser;
     private registerUrlencodedContentParser;
+    private hasCustomBodyParser;
+    private normalizeContentType;
+    private getDefaultBodyParser;
     private registerMiddie;
     private getRequestOriginalUrl;
     private injectRouteOptions;
+    /**
+     * "find-my-way" matches an empty path segment for a route parameter
+     * ("/users//profile" -> { id: "" }), while "path-to-regexp", which
+     * middleware paths (and the ExpressAdapter's routes) are matched with,
+     * needs at least one character per parameter. Requests with an empty route
+     * parameter are passed to the not-found handler instead, as with the
+     * ExpressAdapter, so that middleware and routes always match the same
+     * requests. Only the wildcard ("*") may be empty.
+     */
+    private requireNonEmptyParams;
     /**
      * Fastify still accepts the router options ("ignoreTrailingSlash",
      * "caseSensitive", ...) at the top level, but "initialConfig.routerOptions"

package/adapters/fastify-adapter.js

@@ -8,6 +8,7 @@ import middie from '@fastify/middie';
 import { loadPackage, tryLoadPackage, isNil, isString, isUndefined, } from '@nestjs/common/internal';
 import { AbstractHttpAdapter } from '@nestjs/core';
 import { LegacyRouteConverter } from '@nestjs/core/internal';
+import { getMediaTypeVersion } from './utils/get-media-type-version.util.js';
 const { kRouteContext } = fastifySymbols;
 // Fastify uses `fast-querystring` internally to quickly parse URL query strings.
 import { parse as querystringParse } from 'fast-querystring';
@@ -22,6 +23,12 @@ function isFastifyMultipartPlugin(plugin) {
         (fn[Symbol.for('plugin-meta')]?.name === '@fastify/multipart' ||
             fn.name === 'fastifyMultipart'));
 }
+// Covers "application/json" and the "+json" structured syntax suffix (RFC 6839),
+// e.g. "application/problem+json", with or without parameters.
+function isJsonContentType(contentType) {
+    const mediaType = contentType.split(';')[0].trim().toLowerCase();
+    return (mediaType.startsWith('application/json') || mediaType.endsWith('+json'));
+}
 /**
  * @publicApi
  */
@@ -30,7 +37,12 @@ export class FastifyAdapter extends AbstractHttpAdapter {
     _pathPrefix;
     openConnections = new Set();
     isClosing = false;
+    isShuttingDown = false;
+    return503OnClosing = false;
     _isParserRegistered;
+    // Fastify's `hasContentTypeParser('application/json')` is always true (built-in
+    // parser), so the types registered through `useBodyParser()` are tracked here.
+    registeredContentTypes = new Set();
     onRequestHook;
     onResponseHook;
     isMiddieRegistered;
@@ -79,13 +91,12 @@ export class FastifyAdapter extends AbstractHttpAdapter {
             // Media Type (Accept Header) Versioning Handler
             if (this.versioningOptions?.type === VersioningType.MEDIA_TYPE) {
                 const MEDIA_TYPE_HEADER = 'Accept';
-                const acceptHeaderValue = (req.headers?.[MEDIA_TYPE_HEADER] || req.headers?.[MEDIA_TYPE_HEADER.toLowerCase()]);
-                const acceptHeaderVersionParameter = acceptHeaderValue
-                    ? acceptHeaderValue.split(';')[1]
-                    : undefined;
-                return isUndefined(acceptHeaderVersionParameter)
+                const acceptHeaderValue = req.headers?.[MEDIA_TYPE_HEADER] ||
+                    req.headers?.[MEDIA_TYPE_HEADER.toLowerCase()];
+                const headerVersion = getMediaTypeVersion(acceptHeaderValue, this.versioningOptions.key);
+                return isUndefined(headerVersion)
                     ? VERSION_NEUTRAL // No version was supplied
-                    : acceptHeaderVersionParameter.split(this.versioningOptions.key)[1];
+                    : headerVersion;
             }
             // Header Versioning Handler
             else if (this.versioningOptions?.type === VersioningType.HEADER) {
@@ -116,6 +127,9 @@ export class FastifyAdapter extends AbstractHttpAdapter {
                     ...this.getTopLevelRouterOptions(instanceOrOptions),
                     ...instanceOrOptions?.routerOptions,
                     constraints: {
+                        ...instanceOrOptions?.constraints,
+                        ...instanceOrOptions?.routerOptions
+                            ?.constraints,
                         version: this.versionConstraint,
                     },
                 },
@@ -135,7 +149,28 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         }
         this.instance.addHook('onRequest', (request, reply, done) => {
             if (this.onRequestHook) {
-                this.onRequestHook(request, reply, done);
+                this.runLifecycleHook(this.onRequestHook, request, reply, done);
+            }
+            else {
+                done();
+            }
+        });
+        // Fastify's own `return503OnClosing` only applies once `close()` runs,
+        // which is after the shutdown hooks. Added here rather than in
+        // `initHttpServer()` so that it runs before Nest middleware:
+        // `NestFactory.create()` calls `init()`, which registers middie, first.
+        // Answers with the same body as Fastify's own 503, so that clients get
+        // one response shape for the whole shutdown.
+        this.instance.addHook('onRequest', (request, reply, done) => {
+            if (this.return503OnClosing && this.isShuttingDown) {
+                if (request.raw.httpVersionMajor !== 2) {
+                    reply.header('Connection', 'close');
+                }
+                reply.code(503).send({
+                    error: 'Service Unavailable',
+                    message: 'Service Unavailable',
+                    statusCode: 503,
+                });
             }
             else {
                 done();
@@ -143,13 +178,33 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         });
         this.instance.addHook('onResponse', (request, reply, done) => {
             if (this.onResponseHook) {
-                this.onResponseHook(request, reply, done);
+                this.runLifecycleHook(this.onResponseHook, request, reply, done);
             }
             else {
                 done();
             }
         });
     }
+    runLifecycleHook(hook, request, reply, done) {
+        let completed = false;
+        const doneOnce = (err) => {
+            if (completed)
+                return;
+            completed = true;
+            done(err);
+        };
+        try {
+            // Do not return the promise to Fastify: both completion styles share
+            // this guard, including hooks that call done and return a promise.
+            const result = hook.call(this, request, reply, doneOnce);
+            if (result && typeof result.then === 'function') {
+                result.then(() => doneOnce(), err => doneOnce(err || new fastify.errorCodes.FST_ERR_SEND_UNDEFINED_ERR()));
+            }
+        }
+        catch (err) {
+            doneOnce(err);
+        }
+    }
     setOnRequestHook(hook) {
         this.onRequestHook = hook;
     }
@@ -175,6 +230,11 @@ export class FastifyAdapter extends AbstractHttpAdapter {
     listen(listenOptions, ...args) {
         const isFirstArgTypeofFunction = typeof args[0] === 'function';
         const callback = isFirstArgTypeofFunction ? args[0] : args[1];
+        if (typeof listenOptions === 'string' && Number.isNaN(+listenOptions)) {
+            // A string that is not a number is a Unix socket path or a named pipe.
+            // The host does not apply to it.
+            return this.instance.listen({ path: listenOptions }, callback);
+        }
         let options;
         if (typeof listenOptions === 'object' &&
             (listenOptions.host !== undefined ||
@@ -191,8 +251,23 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         if (!isFirstArgTypeofFunction) {
             options.host = args[0];
         }
+        if (options.port !== undefined && !this.isValidPort(options.port)) {
+            // Fastify calls `server.listen()` from its ready callback, where the
+            // RangeError Node throws for a bad port becomes an unhandled rejection
+            // and the callback never runs. Throw right away instead, as the
+            // `http.Server` of the Express adapter does.
+            const error = new RangeError(`Options.port should be >= 0 and < 65536. Received ${String(options.port)}.`);
+            throw Object.assign(error, { code: 'ERR_SOCKET_BAD_PORT' });
+        }
         return this.instance.listen(options, callback);
     }
+    isValidPort(port) {
+        const value = typeof port === 'string' && port.trim() !== '' ? Number(port) : port;
+        return (typeof value === 'number' &&
+            Number.isInteger(value) &&
+            value >= 0 &&
+            value <= 65535);
+    }
     get(...args) {
         return this.injectRouteOptions('GET', ...args);
     }
@@ -241,6 +316,11 @@ export class FastifyAdapter extends AbstractHttpAdapter {
     unlock(...args) {
         return this.injectRouteOptions('UNLOCK', ...args);
     }
+    all(...args) {
+        const handlerRef = args[args.length - 1];
+        args[args.length - 1] = this.requireNonEmptyParams(args[0], handlerRef);
+        return this.instance.all(...args);
+    }
     applyVersionFilter(handler, version, versioningOptions) {
         if (!this.versioningOptions) {
             this.versioningOptions = versioningOptions;
@@ -282,7 +362,7 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         }
         const responseContentType = fastifyReply.getHeader('Content-Type');
         if (typeof responseContentType === 'string' &&
-            !responseContentType.startsWith('application/json') &&
+            !isJsonContentType(responseContentType) &&
             body?.statusCode >= HttpStatus.BAD_REQUEST) {
             Logger.warn("Content-Type doesn't match Reply body, you might need a custom ExceptionFilter for non-JSON responses", FastifyAdapter.name);
             fastifyReply.header('Content-Type', 'application/json');
@@ -297,7 +377,12 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         return response.code(statusCode);
     }
     end(response, message) {
-        response.raw.end(message);
+        if (this.isNativeResponse(response)) {
+            response.end(message);
+            return;
+        }
+        const reply = response;
+        reply.raw.end(message);
     }
     render(response, view, options) {
         return response && response.view(view, options);
@@ -373,7 +458,11 @@ export class FastifyAdapter extends AbstractHttpAdapter {
     inject(opts) {
         return this.instance.inject(opts);
     }
+    beforeClose() {
+        this.isShuttingDown = true;
+    }
     async close() {
+        this.isShuttingDown = true;
         this.isClosing = true;
         try {
             this.closeOpenConnections();
@@ -389,6 +478,7 @@ export class FastifyAdapter extends AbstractHttpAdapter {
     }
     initHttpServer(options = {}) {
         this.httpServer = this.instance.server;
+        this.return503OnClosing = !!options?.return503OnClosing;
         if (options?.forceCloseConnections) {
             this.trackOpenConnections();
         }
@@ -409,7 +499,13 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         return this.register(loadPackage('@fastify/view', 'FastifyAdapter.setViewEngine()', () => import('@fastify/view')), options);
     }
     isHeadersSent(response) {
-        return response.sent;
+        if (this.isNativeResponse(response)) {
+            return response.headersSent;
+        }
+        const reply = response;
+        // `reply.sent` only covers hijacked or ended replies, not headers
+        // already flushed through `reply.raw`.
+        return reply.sent || reply.raw.headersSent;
     }
     getHeader(response, name) {
         return response.getHeader(name);
@@ -472,23 +568,29 @@ export class FastifyAdapter extends AbstractHttpAdapter {
             : undefined;
     }
     useBodyParser(type, rawBody, options, parser) {
+        if (Array.isArray(type)) {
+            // One by one, so that each content type gets its own default parser.
+            for (const contentType of type) {
+                this.useBodyParser(contentType, rawBody, options, parser);
+            }
+            return;
+        }
         const parserOptions = {
             ...(options || {}),
             parseAs: 'buffer',
         };
+        const bodyParser = parser ?? this.getDefaultBodyParser(type);
         this.getInstance().addContentTypeParser(type, parserOptions, (req, body, done) => {
             if (rawBody === true && Buffer.isBuffer(body)) {
                 req.rawBody = body;
             }
-            if (parser) {
-                parser(req, body, done);
+            if (bodyParser) {
+                bodyParser(req, body, done);
                 return;
             }
             done(null, body);
         });
-        // To avoid the Nest application init to override our custom
-        // body parser, we mark the parsers as registered.
-        this._isParserRegistered = true;
+        this.registeredContentTypes.add(this.normalizeContentType(type));
     }
     async createMiddlewareFactory(requestMethod) {
         if (!this.isMiddieRegistered) {
@@ -576,21 +678,56 @@ export class FastifyAdapter extends AbstractHttpAdapter {
     }
     registerJsonContentParser(rawBody) {
         const contentType = 'application/json';
+        if (this.hasCustomBodyParser(contentType)) {
+            return;
+        }
         const withRawBody = !!rawBody;
         const { bodyLimit } = this.getInstance().initialConfig;
-        this.useBodyParser(contentType, withRawBody, { bodyLimit }, (req, body, done) => {
-            const { onProtoPoisoning, onConstructorPoisoning } = this.instance.initialConfig;
-            const defaultJsonParser = this.instance.getDefaultJsonParser(onProtoPoisoning || 'error', onConstructorPoisoning || 'error');
-            defaultJsonParser(req, body, done);
-        });
+        this.useBodyParser(contentType, withRawBody, { bodyLimit });
     }
     registerUrlencodedContentParser(rawBody) {
         const contentType = 'application/x-www-form-urlencoded';
+        if (this.hasCustomBodyParser(contentType)) {
+            return;
+        }
         const withRawBody = !!rawBody;
         const { bodyLimit } = this.getInstance().initialConfig;
-        this.useBodyParser(contentType, withRawBody, { bodyLimit }, (_req, body, done) => {
-            done(null, querystringParse(body.toString()));
-        });
+        this.useBodyParser(contentType, withRawBody, { bodyLimit });
+    }
+    // A parser registered through `useBodyParser()` takes precedence over the
+    // default one, including a RegExp or catch-all ('*') parser matching the type.
+    hasCustomBodyParser(contentType) {
+        for (const type of this.registeredContentTypes) {
+            if (type === '*' || type === contentType) {
+                return true;
+            }
+            if (isString(type)) {
+                continue;
+            }
+            type.lastIndex = 0;
+            if (type.test(contentType)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    // Fastify stores string content types trimmed and lower-cased.
+    normalizeContentType(type) {
+        return isString(type) ? type.trim().toLowerCase() : type;
+    }
+    getDefaultBodyParser(type) {
+        switch (this.normalizeContentType(type)) {
+            case 'application/json':
+                return (req, body, done) => {
+                    const { onProtoPoisoning, onConstructorPoisoning } = this.instance.initialConfig;
+                    const defaultJsonParser = this.instance.getDefaultJsonParser(onProtoPoisoning || 'error', onConstructorPoisoning || 'error');
+                    defaultJsonParser(req, body, done);
+                };
+            case 'application/x-www-form-urlencoded':
+                return (_req, body, done) => {
+                    done(null, querystringParse(body.toString()));
+                };
+        }
     }
     async registerMiddie() {
         this.isMiddieRegistered = true;
@@ -612,7 +749,7 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         const routeToInject = {
             method: routerMethodKey,
             url: args[0],
-            handler: handlerRef,
+            handler: this.requireNonEmptyParams(args[0], handlerRef),
         };
         if (!this.instance.supportedMethods.includes(routerMethodKey)) {
             this.instance.addHttpMethod(routerMethodKey, { hasBody: true });
@@ -643,6 +780,35 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         }
         return this.instance.route(routeToInject);
     }
+    /**
+     * "find-my-way" matches an empty path segment for a route parameter
+     * ("/users//profile" -> { id: "" }), while "path-to-regexp", which
+     * middleware paths (and the ExpressAdapter's routes) are matched with,
+     * needs at least one character per parameter. Requests with an empty route
+     * parameter are passed to the not-found handler instead, as with the
+     * ExpressAdapter, so that middleware and routes always match the same
+     * requests. Only the wildcard ("*") may be empty.
+     */
+    requireNonEmptyParams(url, handler) {
+        if (isString(url) && !url.includes(':')) {
+            return handler;
+        }
+        const routeHandler = function (request, reply) {
+            const params = request.params;
+            for (const name in params) {
+                if (params[name] === '' && name !== '*') {
+                    reply.callNotFound();
+                    return;
+                }
+            }
+            return handler.call(this, request, reply);
+        };
+        Object.defineProperty(routeHandler, 'name', {
+            configurable: true,
+            value: handler.name,
+        });
+        return routeHandler;
+    }
     /**
      * Fastify still accepts the router options ("ignoreTrailingSlash",
      * "caseSensitive", ...) at the top level, but "initialConfig.routerOptions"

package/adapters/utils/get-media-type-version.util.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Returns the version carried by an `Accept` header for media type versioning,
+ * e.g. `2` for `application/json;v=2` with the `v=` key.
+ *
+ * The version parameter may follow other parameters and may belong to any
+ * media range of a list (`text/html, application/json;v=2`); the first match
+ * wins. Returns `undefined` when no parameter starts with the key.
+ *
+ * Duplicated in each platform package so that a platform package never
+ * depends on a newer `@nestjs/core` than the one installed.
+ */
+export declare function getMediaTypeVersion(acceptHeader: string | string[] | undefined, key: string): string | undefined;

package/adapters/utils/get-media-type-version.util.js

@@ -0,0 +1,26 @@
+/**
+ * Returns the version carried by an `Accept` header for media type versioning,
+ * e.g. `2` for `application/json;v=2` with the `v=` key.
+ *
+ * The version parameter may follow other parameters and may belong to any
+ * media range of a list (`text/html, application/json;v=2`); the first match
+ * wins. Returns `undefined` when no parameter starts with the key.
+ *
+ * Duplicated in each platform package so that a platform package never
+ * depends on a newer `@nestjs/core` than the one installed.
+ */
+export function getMediaTypeVersion(acceptHeader, key) {
+    const mediaRanges = []
+        .concat(acceptHeader ?? [])
+        .flatMap(value => value.split(','));
+    for (const mediaRange of mediaRanges) {
+        const [, ...parameters] = mediaRange.split(';');
+        for (const parameter of parameters) {
+            const trimmedParameter = parameter.trim();
+            if (trimmedParameter.startsWith(key)) {
+                return trimmedParameter.slice(key.length);
+            }
+        }
+    }
+    return undefined;
+}

package/multipart/interfaces/multipart-options.interface.d.ts

@@ -39,6 +39,18 @@ export interface MultipartLimits {
     parts?: number;
     /** For multipart forms, the max number of header key => value pairs to parse (Default: 2000) */
     headerPairs?: number;
+    /**
+     * Max nesting depth of field names; `a[b][c]` has 2 levels (Default:
+     * Infinity). Like `fieldNameSize`, it does not fall back to the options
+     * `@fastify/multipart` was registered with.
+     */
+    fieldNestingDepth?: number;
+    /**
+     * Max numeric array index accepted in field names; `a[3]` uses index 3
+     * (Default: Infinity). Like `fieldNameSize`, it does not fall back to the
+     * options `@fastify/multipart` was registered with.
+     */
+    fieldArrayIndexLimit?: number;
 }
 /**
  * Same keys and semantics as platform-express's `MulterOptions`, so option

package/multipart/multipart/append-field.util.d.ts

@@ -1,6 +1,7 @@
 /**
  * Appends a text field to `store` using multer's bracket notation.
- * Returns `false` (leaving `store` untouched) for names that would pollute a
- * prototype.
+ * Returns `false` for names it cannot apply: names that would pollute a
+ * prototype (leaving `store` untouched) and appends to an array that already
+ * has the maximum length.
  */
 export declare function appendField(store: object, key: string, value: unknown): boolean;

package/multipart/multipart/append-field.util.js

@@ -84,11 +84,13 @@ function setValue(ctx, step, current, value) {
             }
             obj = Object.create(null);
             ctx[step.key] = obj;
-            current.forEach((item, i) => {
-                if (item !== undefined) {
-                    obj['' + i] = item;
+            // Only the indices that hold a value, so that the work depends on the
+            // number of items rather than on the length of a sparse array.
+            for (const index of Object.keys(current)) {
+                if (current[index] !== undefined) {
+                    obj[index] = current[index];
                 }
-            });
+            }
             return obj;
         case 'scalar':
             obj = Object.create(null);
@@ -99,14 +101,23 @@ function setValue(ctx, step, current, value) {
 }
 /**
  * Appends a text field to `store` using multer's bracket notation.
- * Returns `false` (leaving `store` untouched) for names that would pollute a
- * prototype.
+ * Returns `false` for names it cannot apply: names that would pollute a
+ * prototype (leaving `store` untouched) and appends to an array that already
+ * has the maximum length.
  */
 export function appendField(store, key, value) {
     const steps = parsePath(key);
     if (steps.some(step => FORBIDDEN_KEYS.has(String(step.key)))) {
         return false;
     }
-    steps.reduce((ctx, step) => setValue(ctx, step, ctx[step.key], value), store);
+    try {
+        steps.reduce((ctx, step) => setValue(ctx, step, ctx[step.key], value), store);
+    }
+    catch (err) {
+        if (err instanceof RangeError) {
+            return false;
+        }
+        throw err;
+    }
     return true;
 }

package/multipart/multipart/multipart.constants.d.ts

@@ -14,6 +14,7 @@ export declare const multerExceptions: {
     readonly LIMIT_UNEXPECTED_FILE: "Unexpected file field";
     readonly MISSING_FIELD_NAME: "Field name missing";
     readonly LIMIT_FIELD_NESTING: "Field name nesting too deep";
+    readonly LIMIT_FIELD_ARRAY_INDEX: "Field name array index too large";
     readonly INVALID_FIELD_NAME: "Invalid field name";
 };
 export type MultipartErrorCode = keyof typeof multerExceptions;

package/multipart/multipart/multipart.constants.js

@@ -15,6 +15,7 @@ export const multerExceptions = {
     LIMIT_UNEXPECTED_FILE: 'Unexpected file field',
     MISSING_FIELD_NAME: 'Field name missing',
     LIMIT_FIELD_NESTING: 'Field name nesting too deep',
+    LIMIT_FIELD_ARRAY_INDEX: 'Field name array index too large',
     // A multer 2.4 code that platform-express's table lacks. Raised here for
     // field names that would pollute a prototype, which multer accepts.
     INVALID_FIELD_NAME: 'Invalid field name',

package/multipart/multipart/multipart.parser.js

@@ -197,6 +197,36 @@ function checkFieldNameSize(rawName, limits) {
         throw new MultipartError('LIMIT_FIELD_KEY');
     }
 }
+/**
+ * Whether the field name holds a numeric index above `limit`, decided as
+ * multer does. Only a name `appendField` parses as a bracket path builds an
+ * array; one it keeps as a literal key (`a[6]suffix`, `[6]`) never does.
+ */
+function exceedsArrayIndexLimit(name, limit) {
+    if (!/^[^[]+(?:\[[^\]]+\])*(?:\[\])?$/.test(name)) {
+        return false;
+    }
+    for (const [, index] of name.matchAll(/\[(\d+)\]/g)) {
+        if (Number(index) > limit) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * `fieldNestingDepth` and `fieldArrayIndexLimit` are multer's own limits
+ * (busboy knows neither), so they are checked here, against the decoded name.
+ */
+function checkFieldNameShape(name, limits) {
+    if (typeof limits?.fieldNestingDepth === 'number' &&
+        name.split('[').length - 1 > limits.fieldNestingDepth) {
+        throw new MultipartError('LIMIT_FIELD_NESTING', name);
+    }
+    if (typeof limits?.fieldArrayIndexLimit === 'number' &&
+        exceedsArrayIndexLimit(name, limits.fieldArrayIndexLimit)) {
+        throw new MultipartError('LIMIT_FIELD_ARRAY_INDEX', name);
+    }
+}
 /**
  * Adds a text field to `body`, with multer's checks, in multer's order.
  */
@@ -209,6 +239,7 @@ function appendTextField(body, part, limits) {
         throw new MultipartError('LIMIT_FIELD_VALUE', part.fieldname);
     }
     checkFieldNameSize(rawName, limits);
+    checkFieldNameShape(part.fieldname, limits);
     if (!appendField(body, part.fieldname, part.value)) {
         throw new MultipartError('INVALID_FIELD_NAME', part.fieldname);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/platform-fastify",
-  "version": "12.1.1",
+  "version": "12.1.3",
   "description": "Nest - modern, fast, powerful node.js web framework (@platform-fastify)",
   "author": "Kamil Mysliwiec",
   "license": "MIT",
@@ -26,9 +26,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@fastify/cors": "11.3.0",
-    "@fastify/formbody": "9.0.0",
-    "@fastify/middie": "9.3.4",
+    "@fastify/cors": "11.3.1",
+    "@fastify/formbody": "9.0.1",
+    "@fastify/middie": "9.3.5",
     "fast-querystring": "1.1.2",
     "fastify": "5.12.5",
     "find-my-way": "9.9.0",
@@ -54,5 +54,5 @@
       "optional": true
     }
   },
-  "gitHead": "9feedffde8ef8c86f0cd521153740575dc579d88"
+  "gitHead": "4514623279f6087808e3c8f08fbf9f37d3c17482"
 }