# express: what changed from 4 to 5

- Product: express (https://whatsnew.fyi/product/express)
- Vendor: express
- Range: changelog entries numbered after v4.22.2 up to and including v5.2.1, stable releases only
- Entries below: 4 releases (newest first)
- Resolved: 4 is v4.22.2 and 5 is v5.2.1, the newest stable release of each major we track
- Carrying security changes: 3 · CVEs mentioned: 3 · Mentioning breaking changes: 1 · Removing or deprecating something: 2
- Page: https://whatsnew.fyi/product/express/compare/4...5

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (25 changes, grouped by kind)

### Added

#### v5.1.0 (2025-03-31)

- Add support for ETag option in res.sendFile

### Changed

#### v5.2.0 (2025-12-01)

- Simplify acceptsLanguages implementation using spread operator
- Use req.socket over deprecated req.connection
- Use node protocol for querystring
- Enforce explicit Buffer import and add lint rule
- Use cached slice in app.listen

#### v5.1.0 (2025-03-31)

- Use loop for acceptParams
- Simplify normalizeTypes function
- Extend res.links() to allow adding multiple links with the same rel
- Update body-parser to ^2.1.0
- Update router to ^2.1.0
- Update debug to ^4.4.0
- Update qs to ^6.14.0
- Update finalhandler to 2.1.0

### Fixed

#### v5.2.1 (2025-12-01)

- Revert erroneous breaking change related to the extended query parser that was introduced in version 5.2.0

#### v5.2.0 (2025-12-01)

- Upgrade body-parser to 2.2.1 to address CVE-2025-13466

#### v5.1.0 (2025-03-31)

- Use node:buffer instead of safe-buffer

### Removed

#### v5.1.0 (2025-03-31)

- Remove Object.setPrototypeOf polyfill
- Replace methods dependency with standard library
- Remove utils-merge dependency and use spread syntax instead
- Remove unused depd dependency

### Deprecated

#### v5.2.0 (2025-12-01)

- Add deprecation warnings for redirect arguments undefined

### Security

#### v5.2.0 (2025-12-01)

- Fix security vulnerability CVE-2024-51999

#### v5.1.0 (2025-03-31)

- Fix vulnerabilities

#### v5.0.1 (2024-10-08)

- Update cookie dependency semver lock to address CVE-2024-47764

## Release notes

### v5.2.1

- Date: 2025-12-01
- Version: v5.2.1
- Original notes: https://github.com/expressjs/express/releases/tag/v5.2.1
- Permalink: https://whatsnew.fyi/product/express/releases/v5.2.1

- **fixed** — Revert erroneous breaking change related to the extended query parser that was introduced in version 5.2.0

##### What's Changed

> [!IMPORTANT]  
> The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

* Release: 5.2.1 by @UlisesGascon in https://github.com/expressjs/express/pull/6933

**Full Changelog**: https://github.com/expressjs/express/compare/v5.2.0...v5.2.1

### v5.2.0

- Date: 2025-12-01
- Version: v5.2.0
- Original notes: https://github.com/expressjs/express/releases/tag/v5.2.0
- Permalink: https://whatsnew.fyi/product/express/releases/v5.2.0

- **security** — Fix security vulnerability CVE-2024-51999
- **deprecated** — Add deprecation warnings for redirect arguments undefined
- **changed** — Simplify acceptsLanguages implementation using spread operator
- **changed** — Use req.socket over deprecated req.connection
- **changed** — Use node protocol for querystring
- **changed** — Enforce explicit Buffer import and add lint rule
- **changed** — Use cached slice in app.listen
- **fixed** — Upgrade body-parser to 2.2.1 to address CVE-2025-13466

##### Important: Security

* Security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6))


##### What's Changed
* build(deps): bump github/codeql-action from 3.28.11 to 3.28.13 by @dependabot[bot] in https://github.com/expressjs/express/pull/6429
* Refactor: simplify `acceptsLanguages` implementation using spread operator by @Ayoub-Mabrouk in https://github.com/expressjs/express/pull/6137
* increased code coverage of utils.js file by @ashish3011 in https://github.com/expressjs/express/pull/6386
* chore: remove duplicate word by @dufucun in https://github.com/expressjs/express/pull/6456
* build(deps): bump github/codeql-action from 3.28.13 to 3.28.16 by @dependabot[bot] in https://github.com/expressjs/express/pull/6498
* build(deps): bump actions/setup-node from 4.3.0 to 4.4.0 by @dependabot[bot] in https://github.com/expressjs/express/pull/6497
* build(deps): bump actions/download-artifact from 4.2.1 to 4.3.0 by @dependabot[bot] in https://github.com/expressjs/express/pull/6496
* ci: add node.js 24 to test matrix by @Phillip9587 in https://github.com/expressjs/express/pull/6504
* ci: update codeql config by @Phillip9587 in https://github.com/expressjs/express/pull/6488
* chore: wider range for query test skip by @jonchurch in https://github.com/expressjs/express/pull/6512
* chore: fix typos in test by @noritaka1166 in https://github.com/expressjs/express/pull/6535
* ci: disable credential persistence for checkout actions by @mertssmnoglu in https://github.com/expressjs/express/pull/6522
* ci: allow manual triggering of workflow by @shivarm in https://github.com/expressjs/express/pull/6515
* test: add coverage for app.listen() variants by @kgarg1 in https://github.com/expressjs/express/pull/6476
* docs: move documentation and charters to the discussions and .github … by @bjohansebas in https://github.com/expressjs/express/pull/6427
* build(deps): bump github/codeql-action from 3.28.16 to 3.28.18 by @dependabot[bot] in https://github.com/expressjs/express/pull/6549
* build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in https://github.com/expressjs/express/pull/6548
* chore: enforce explicit `Buffer` import and add lint rule by @shivarm in https://github.com/expressjs/express/pull/6525
* chore: use node protocol for querystring by @shivarm in https://github.com/expressjs/express/pull/6520
* chore: fix typo by @mountdisk in https://github.com/expressjs/express/pull/6609
* build(deps): bump github/codeql-action from 3.28.18 to 3.29.2 by @dependabot[bot] in https://github.com/expressjs/express/pull/6618
* add deprecation warnings for redirect arguments undefined by @bjohansebas in https://github.com/expressjs/express/pull/6405
* ci: run CI when the markdown changes by @bjohansebas in https://github.com/expressjs/express/pull/6632
* doc: fix CONTRIBUTING link by @jonchurch in https://github.com/expressjs/express/pull/6653
* doc: update contributing guidelines and code of conduct links by @ShubhamOulkar in https://github.com/expressjs/express/pull/6601
* build(deps-dev): bump morgan from 1.10.0 to 1.10.1 by @dependabot[bot] in https://github.com/expressjs/express/pull/6679
* build(deps-dev): bump cookie-session from 2.1.0 to 2.1.1 by @dependabot[bot] in https://github.com/expressjs/express/pull/6678
* lint: add --fix flag to automatic fix linting issue by @shivarm in https://github.com/expressjs/express/pull/6644
* chore: ignore yarn.lock file and update example by @shivarm in https://github.com/expressjs/express/pull/6588
* lib: use req.socket over deprecated req.connection by @bjohansebas in https://github.com/expressjs/express/pull/6705
* doc: update express app example by @shivarm in https://github.com/expressjs/express/pull/6718
* build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 by @dependabot[bot] in https://github.com/expressjs

_[Truncated at 4000 characters — full notes: https://github.com/expressjs/express/releases/tag/v5.2.0]_

### v5.1.0

- Date: 2025-03-31
- Version: v5.1.0
- Original notes: https://github.com/expressjs/express/releases/tag/v5.1.0
- Permalink: https://whatsnew.fyi/product/express/releases/v5.1.0

- **removed** — Remove Object.setPrototypeOf polyfill
- **fixed** — Use node:buffer instead of safe-buffer
- **changed** — Use loop for acceptParams
- **removed** — Replace methods dependency with standard library
- **removed** — Remove utils-merge dependency and use spread syntax instead
- **security** — Fix vulnerabilities
- **removed** — Remove unused depd dependency
- **changed** — Simplify normalizeTypes function
- **added** — Add support for ETag option in res.sendFile
- **changed** — Extend res.links() to allow adding multiple links with the same rel
- **changed** — Update body-parser to ^2.1.0
- **changed** — Update router to ^2.1.0
- **changed** — Update debug to ^4.4.0
- **changed** — Update qs to ^6.14.0
- **changed** — Update finalhandler to 2.1.0

##### What's Changed
* Update captains by @UlisesGascon in https://github.com/expressjs/express/pull/6027
* build: Node.js 23.0 by @bjohansebas in https://github.com/expressjs/express/pull/6075
* Add funding field (v5) by @bjohansebas in https://github.com/expressjs/express/pull/6064
* ✅ add discarded middleware test by @ctcpip in https://github.com/expressjs/express/pull/5819
* update homepage link http to https by @bjohansebas in https://github.com/expressjs/express/pull/5920
* Improve readme by @bjohansebas in https://github.com/expressjs/express/pull/5994
* Add bjohansebas as repo captain for expressjs.com by @crandmck in https://github.com/expressjs/express/pull/6058
* Remove Object.setPrototypeOf polyfill by @Phillip9587 in https://github.com/expressjs/express/pull/6081
* fix(buffer): use node:buffer instead of safe-buffer by @bhavya3024 in https://github.com/expressjs/express/pull/6071
* docs: Add DCO by @UlisesGascon in https://github.com/expressjs/express/pull/6048
* cleanup: remove promise support check from tests by @Phillip9587 in https://github.com/expressjs/express/pull/6148
* Use loop for acceptParams by @blakeembrey in https://github.com/expressjs/express/pull/6066
* Improve documentation step in release process by @bjohansebas in https://github.com/expressjs/express/pull/6150
* cleanup: remove unnecessary require for global Buffer by @Phillip9587 in https://github.com/expressjs/express/pull/6146
* cleanup: remove AsyncLocalStorage check by @Phillip9587 in https://github.com/expressjs/express/pull/6147
* update history.md for acceptParams change by @jonchurch in https://github.com/expressjs/express/pull/6177
* docs: add @rxmarbles to the triage team by @UlisesGascon in https://github.com/expressjs/express/pull/6151
* refactor: improve readability by @sazk07 in https://github.com/expressjs/express/pull/6173
* docs: clarify the security process in the triage role by @bjohansebas in https://github.com/expressjs/express/pull/6217
* chore: replace `methods` dependency with standard library by @jonkoops in https://github.com/expressjs/express/pull/6196
* Remove `utils-merge` dependency - use spread syntax instead by @Phillip9587 in https://github.com/expressjs/express/pull/6091
* fix(securite): fix vulnerabilities by @Abdel-Monaam-Aouini in https://github.com/expressjs/express/pull/6211
* refactor: prefix built-in node module imports by @slagiewka in https://github.com/expressjs/express/pull/6236
* fix: remove download size badges by @wesleytodd in https://github.com/expressjs/express/pull/6266
* Remove unused `depd` dependency by @jonkoops in https://github.com/expressjs/express/pull/6197
* fix: usage of `Invalid action input 'persist-credentials'` for `actions/setup-node@v4` in `ci.yml` by @hamirmahal in https://github.com/expressjs/express/pull/6256
* Add support for OSSF scorecard reporting by @UlisesGascon in https://github.com/expressjs/express/pull/5431
* docs: add @Phillip9587 to the triage team by @bjohansebas in https://github.com/expressjs/express/pull/6276
* fix: added a missing semicolon in css styles in examples/auth by @pr4j3sh in https://github.com/expressjs/express/pull/6297
* docs: include team email in the security policy by @UlisesGascon in https://github.com/expressjs/express/pull/6278
* refactor: simplify `normalizeTypes` function by @Ayoub-Mabrouk in https://github.com/expressjs/express/pull/6097
* ci: updated github actions ci workflow by @Phillip9587 in https://github.com/expressjs/express/pull/6314
* ci: fix npm install --include typo by @Phillip9587 in https://github.com/expressjs/express/pull/6324
* ci: updated scorecard actions by @Phillip9587 in https://github.com/expressjs/express/pull/6322
* build(deps): use carat notation for dependency versions by @dpopp07 in https://github.com/expressjs/express/pull/6317
* chore(deps): update `debug` to ^4.4.0 by @Phillip9587 in https://github.com/expressjs/express/pull/6313
* docs: retroactively note 5.0.0-beta.

_[Truncated at 4000 characters — full notes: https://github.com/expressjs/express/releases/tag/v5.1.0]_

### v5.0.1 — 5.0.1

- Date: 2024-10-08
- Version: v5.0.1
- Original notes: https://github.com/expressjs/express/releases/tag/v5.0.1
- Permalink: https://whatsnew.fyi/product/express/releases/v5.0.1

- **security** — Update cookie dependency semver lock to address CVE-2024-47764

##### What's Changed
* remove --bail from test script by @jonchurch in https://github.com/expressjs/express/pull/5962
* Nominate @bjohansebas to the triage team by @UlisesGascon in https://github.com/expressjs/express/pull/6009
* Link and update captains by @blakeembrey in https://github.com/expressjs/express/pull/6013
* Update `cookie` semver lock to address CVE-2024-47764 by @joshbuker in https://github.com/expressjs/express/pull/6017
* Release: 5.0.1 by @UlisesGascon in https://github.com/expressjs/express/pull/6032


**Full Changelog**: https://github.com/expressjs/express/compare/v5.0.0...5.0.1