Diagnosing NestJS Global Validation Pipe Not Throwing Errors on Invalid DTOs

Recognizable Condition

When a client sends a request with data that violates DTO constraints (e.g., a missing required field or a wrong type), the NestJS controller still receives the object and returns a successful response. The expected BadRequestException from the global ValidationPipe is not thrown, indicating that validation is bypassed or the pipe is not active.

Cause/Diagnostic Table

Possible Cause	What You Observe
ValidationPipe not registered globally or overridden at module level	No validation errors appear; requests reach handler unchanged.
enableImplicitConversion missing or false	Type mismatches (e.g., string sent for a number field) are not coerced, so validation passes on the raw string.
DTO defined as plain object or missing class‑transformer options	Decorators are ignored because the instance is not a class; validation runs on a plain object.
Local ValidationPipe with conflicting options (e.g., whitelist: false)	Global settings are overridden, stripping or allowing properties unexpectedly.
Missing or incompatible class-validator/class-transformer packages	Pipe instantiates but throws silently; no validation logic runs.

Ordered Checks

1. Verify global pipe registration in main.ts (or bootstrap function):

   import { ValidationPipe } from '@nestjs/pipes';
   app.useGlobalPipes(new ValidationPipe({ whitelist: true, forbidNonWhitelisted: true, transform: true }));
   

2. Ensure class-validator and class-transformer are installed and compatible with your NestJS version (e.g., npm ls class-validator class-transformer).
3. Confirm DTOs are proper classes and decorated correctly; they should be referenced via @Body() without manual parsing.
4. Search for any module‑level ValidationPipe providers that could override the global instance.
5. Enable debug logging for @nestjs/common and look for validation error messages during request processing.

Fixes Tied to Findings

• If step 1 fails, add the global ValidationPipe with transform: true as shown above.
• If step 2 shows missing or mismatched versions, run npm i class-validator@^0.13.0 class-transformer@^0.5.1 (adjust to match your NestJS version).
• If step 3 reveals plain objects, ensure you are not manually converting the payload (e.g., avoid req.body) and set enableImplicitConversion: true in the pipe options if you need loose type coercion.
• If step 4 uncovers a local pipe, either remove it or align its options with the global pipe (especially whitelist and forbidNonWhitelisted).
• If step 5 shows no logs, set logger.logLevel to LogLevel.DEBUG in main.ts and redeploy; validation errors should appear as BadRequestException traces.

Verification

1. Start the application and send a request with a deliberately invalid payload, for example:

curl -X POST http://localhost:3000/users \
  -H "Content-Type: application/json" \
  -d '{"name": "Test"}'   // missing required 'age' field

You should receive a 400 Bad Request response containing a validation error array similar to:
[
  {
    "property": "age",
    "constraints": {
      "isNotEmpty": "age should not be empty"
    }
  }
]


Send a request with extra non‑whitelisted properties:

curl -X POST http://localhost:3000/users \
  -H "Content-Type: application/json" \
  -d '{"name": "Jane", "age": 30, "extra": "should be stripped"}'

Inside the controller, log the received DTO; the extra property should be absent if whitelist: true and forbidNonWhitelisted: true are active.

Check NestJS startup logs for a line like:

[Nest] 12345   - 10/15/2026, 7:45:00 AM   [NestFactory] Starting Nest application...
Followed by a debug line indicating the global pipe was registered (if debug logging is enabled).

Escalation Criteria
If after completing the checks above the validation still does not behave as expected—e.g., nested objects are not validated, custom validators are ignored, or you notice significant performance degradation—consider the following steps:

Create a minimal reproducible example (DTO, controller, pipe configuration) and open an issue in the NestJS GitHub repository.
Share the reproduction on the NestJS Discord or Stack Overflow using the nestjs tag, including your package versions and the exact pipe options you are using.
Enable full trace logging (logger.enableDebug()) and capture the request lifecycle to identify where validation is being short‑circuited.