Use the exceptionFactory option to replace the default error serialization. The factory receives the array of ValidationError objects from class-validator and must return an HttpException. This allows you to shape the errors array to match your API contract exactly.
The factory receives ValidationError[] — each entry has property, value, constraints, and children.
children contains nested DTO errors — always handle them recursively for complete error reporting.
Return any HttpException subclass — UnprocessableEntityException (422) is also a common choice.
In production set validationError: { target: false, value: false } to avoid leaking request data.
Combine with stopAtFirstError: true to return only the first violation per field.