What’s New

express

Frameworks & Libraries

express release notes.

Latest v4.22.2 · by expressWebsiteexpressjs/express

Changelog

v4.22.2

Changed
  • Update qs to ~6.15.1
  • Update body-parser to ~1.20.5
Fixed
  • Restore >20 array parsing for req.query repeated keys and unify array-cap behavior across notations to allow up to 1000 items
What's Changed
  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5
New Contributors

Full Changelog: https://github.com/expressjs/express/compare/v4.22.1...v4.22.2

View originalPermalink

v4.22.1

Fixed
  • Revert erroneous breaking change related to the extended query parser from the prior release
What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: https://github.com/expressjs/express/compare/4.22.0...v4.22.1

View originalPermalink

v5.2.1

Fixed
  • Revert erroneous breaking change related to the extended query parser that was introduced in version 5.2.0
What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: https://github.com/expressjs/express/compare/v5.2.0...v5.2.1

View originalPermalink

v5.2.0

Changed
  • Simplify acceptsLanguages implementation using spread operator
  • Use req.socket over deprecated req.connection
  • Use node protocol for querystring
  • Enforce explicit Buffer import and add lint rule
  • Use cached slice in app.listen
Fixed
  • Upgrade body-parser to 2.2.1 to address CVE-2025-13466
Deprecated
  • Add deprecation warnings for redirect arguments undefined
Security
  • Fix security vulnerability CVE-2024-51999
Important: Security
What's Changed
New Contributors

Full Changelog: https://github.com/expressjs/express/compare/v5.1.0...v5.2.0

View originalPermalink

4.22.0

Changed
  • Update qs to 6.14.0
Fixed
  • Method functions with no path should error
Security
  • Security fix for CVE-2024-51999
Important: Security
What's Changed

Full Changelog: https://github.com/expressjs/express/compare/4.21.2...4.22.0

View originalPermalink

v5.1.0

Added
  • Add support for ETag option in res.sendFile
Changed
  • Use loop for acceptParams
  • Simplify normalizeTypes function
  • Extend res.links() to allow adding multiple links with the same rel
  • Update body-parser to ^2.1.0
  • Update router to ^2.1.0
  • Update debug to ^4.4.0
  • Update qs to ^6.14.0
  • Update finalhandler to 2.1.0
Fixed
  • Use node:buffer instead of safe-buffer
Removed
  • Remove Object.setPrototypeOf polyfill
  • Replace methods dependency with standard library
  • Remove utils-merge dependency and use spread syntax instead
  • Remove unused depd dependency
Security
  • Fix vulnerabilities
What's Changed
New Contributors

Full Changelog: https://github.com/expressjs/express/compare/5.0.1...v5.1.0

View originalPermalink

4.21.2

Changed
  • Update path-to-regexp to 0.1.12
What's Changed

Full Changelog: https://github.com/expressjs/express/compare/4.21.1...4.21.2

View originalPermalink
v5.0.1

5.0.1

Security
  • Update cookie dependency semver lock to address CVE-2024-47764
What's Changed

Full Changelog: https://github.com/expressjs/express/compare/v5.0.0...5.0.1

View originalPermalink

4.21.0

Changed
  • Upgrade finalhandler to 1.3.1
  • Upgrade serve-static to 1.16.2
  • Upgrade qs to 6.13.0 to match qs in body-parser
Deprecated
  • Deprecate "back" magic string in redirects
What's Changed
New Contributors

Full Changelog: https://github.com/expressjs/express/compare/4.20.0...4.21.0

View originalPermalink