The standard NestJS Passport JWT guard costs about 270 microseconds per request because jsonwebtoken is slow, capping a protected Express route near 2,900 requests per second.
We reproduced four traps on NestJS 12: a 3600 string expiry that lasts three seconds, stale roles after demotion, bcryptjs freezing the event loop, and slow token verification.
The new @nestjs/authentication 0.1.1 package avoids most of them, but it is a 0.1 release, so pin the version and lower its default scrypt cost.