What changed in express from 4 to 5

4 releases numbered after v4.22.2 up to and including v5.2.1, stable releases only. v4.22.2 and v5.2.1 are the newest stable releases of 4 and 5 we track; this page follows them as new ones ship.

25 changes across 4 releases

Added 1

v5.1.0

  • Add support for ETag option in res.sendFile
Changed 13

v5.2.0

  • Simplify acceptsLanguages implementation using spread operator
  • Use req.socket over deprecated req.connection
  • Use node protocol for querystring
  • Enforce explicit Buffer import and add lint rule
  • Use cached slice in app.listen

v5.1.0

  • Use loop for acceptParams
  • Simplify normalizeTypes function
  • Extend res.links() to allow adding multiple links with the same rel
  • Update body-parser to ^2.1.0
  • Update router to ^2.1.0
  • Update debug to ^4.4.0
  • Update qs to ^6.14.0
  • Update finalhandler to 2.1.0
Fixed 3

v5.2.1

  • Revert erroneous breaking change related to the extended query parser that was introduced in version 5.2.0

v5.2.0

  • Upgrade body-parser to 2.2.1 to address CVE-2025-13466

v5.1.0

  • Use node:buffer instead of safe-buffer
Removed 4

v5.1.0

  • Remove Object.setPrototypeOf polyfill
  • Replace methods dependency with standard library
  • Remove utils-merge dependency and use spread syntax instead
  • Remove unused depd dependency
Deprecated 1

v5.2.0

  • Add deprecation warnings for redirect arguments undefined
Security 3

v5.2.0

  • Fix security vulnerability CVE-2024-51999

v5.1.0

  • Fix vulnerabilities

v5.0.1

  • Update cookie dependency semver lock to address CVE-2024-47764

Original release notes, newest first

The list above is our reading of these notes; the originals from express are here, one fold per release.

v5.2.1
What's Changed

[!IMPORTANT]
The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: https://github.com/expressjs/express/compare/v5.2.0...v5.2.1

View originalPermalink

v5.2.0
Important: Security
What's Changed
New Contributors

Full Changelog: https://github.com/expressjs/express/compare/v5.1.0...v5.2.0

View originalPermalink

v5.1.0
What's Changed
New Contributors

Full Changelog: https://github.com/expressjs/express/compare/5.0.1...v5.1.0

View originalPermalink

v5.0.15.0.1
What's Changed

Full Changelog: https://github.com/expressjs/express/compare/v5.0.0...5.0.1

View originalPermalink