NestJS End of Life (EOL) Dates & Support Timeline
Complete end-of-life dates, support windows, and security status for all NestJS versions. Data sourced from endoflife.date and official vendor documentation. Updated at every deploy.
| Version | Latest Release | Release Date | EOL Date | Days | Status |
|---|---|---|---|---|---|
| 6 | 6.11.11 | Mar 16, 2019 | Mar 3, 2020 | 2334 days past EOL | EOL |
| 7 | 7.6.18 | Mar 13, 2020 | Jun 17, 2021 | 1863 days past EOL | EOL |
| 8 | 8.4.7 | Jul 7, 2021 | Jun 14, 2022 | 1501 days past EOL | EOL |
| 9 | 9.4.3 | Jul 8, 2022 | Jun 12, 2023 | 1138 days past EOL | EOL |
| 10 | 10.4.22 | Jun 15, 2023 | TBD | Supported | Active |
| 11 | 11.1.28 | Jan 16, 2025 | TBD | Supported | Active |
Live EOL badge for your README — updates automatically at every build.
[](https://endoflife.ai/nestjs)
NestJS lifecycle status — the real story
NestJS ships a new major roughly every year but publishes no formal support schedule — the project's security policy names a disclosure contact, not a timeline. In practice, a major stops receiving releases within days of its successor shipping: NestJS 9's final release (9.4.3, June 12 2023) landed three days before v10 arrived. We therefore date each closed line's EOL to its final published release, a convention flagged here because no vendor-stated date exists.
The exception is the previous major, which historically keeps receiving patches well past the handoff — v10 was still getting releases in January 2026, a year after v11 shipped. With millions of weekly downloads of @nestjs/core, NestJS is the default structure for enterprise Node.js backends, which means v8 and v9 apps are still common in production long after their maintenance quietly ended.
The practical risk compounds through the adapter layer: a NestJS app pins Express or Fastify underneath it, so staying on a dead Nest major tends to pin an aging HTTP framework too. Commercial extended support exists for NestJS 9 for teams that cannot migrate on the community's implicit timeline.
What does NestJS end of life mean for your organization?
When a version of NestJS reaches end of life, the maintainers stop issuing security patches. Vulnerabilities discovered after this date are publicly disclosed on the National Vulnerability Database, exploit code appears on GitHub, and your systems remain permanently exposed.
The CVE blind spot: Most vulnerability scanners check for known CVEs but do not flag the accumulation of unpatched vulnerabilities in EOL software. With a zero-day, nobody knows about the vulnerability. With EOL software, the vulnerability is public — listed, rated, and often weaponized — but no patch will ever exist. This is the most dangerous gap in enterprise security posture.
Organizations running EOL NestJS should treat it as a vulnerability class in their risk register, apply compensating controls (network segmentation, enhanced monitoring, access restriction), and prioritize migration to a supported version.
Extended Support Options
If you cannot migrate immediately, extended support vendors provide continued security patches for EOL NestJS versions. This is a bridge, not a permanent solution — plan your migration in parallel.
NestJS has 4 versions past end of life — security patches have stopped, but CVE disclosures haven't. The good news: extended support for NestJS exists — vetted vendors ship security patches for years past the official date. Right now that coverage spans NestJS 9. Tell us where to reach you and we'll reply with matched options and pricing guidance.