# express changelog

> express release notes.

- Vendor: express
- Category: Frameworks & Libraries
- Official site: https://expressjs.com/
- Tracked by: What's New (https://whatsnew.fyi/product/express)
- Harvested from: GitHub (expressjs/express)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### v4.22.2

- Date: 2026-05-11
- Version: v4.22.2
- Original notes: https://github.com/expressjs/express/releases/tag/v4.22.2
- Permalink: https://whatsnew.fyi/product/express/releases/v4.22.2

- **fixed** — Restore >20 array parsing for req.query repeated keys and unify array-cap behavior across notations to allow up to 1000 items
- **changed** — Update qs to ~6.15.1
- **changed** — Update body-parser to ~1.20.5

##### What's Changed

* fix: restore >20 array parsing for `req.query` repeated keys ([`8d09bfe6`](https://github.com/expressjs/express/commit/8d09bfe6d88983da5c3e12cfdd54782c4dc675db))
  * This also unifies array-cap behavior across notations. Indexed notation (`a[0]=...`) was historically capped at qs's default `arrayLimit` of 20 even in older qs versions; after this change it also allows up to 1000 items.
* deps: qs@~6.15.1
* deps: body-parser@~1.20.5


##### New Contributors
* @suuuuuuminnnnnn made their first contribution in https://github.com/expressjs/express/pull/7021
* @SAY-5 made their first contribution in https://github.com/expressjs/express/pull/7181

**Full Changelog**: https://github.com/expressjs/express/compare/v4.22.1...v4.22.2

### v4.22.1

- Date: 2025-12-01
- Version: v4.22.1
- Original notes: https://github.com/expressjs/express/releases/tag/v4.22.1
- Permalink: https://whatsnew.fyi/product/express/releases/v4.22.1

- **fixed** — Revert erroneous breaking change related to the extended query parser from the prior release

##### What's Changed

> [!IMPORTANT]  
> The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

* Release: 4.22.1 by @UlisesGascon in https://github.com/expressjs/express/pull/6934


**Full Changelog**: https://github.com/expressjs/express/compare/4.22.0...v4.22.1

### v5.2.1

- Date: 2025-12-01
- Version: v5.2.1
- Original notes: https://github.com/expressjs/express/releases/tag/v5.2.1
- Permalink: https://whatsnew.fyi/product/express/releases/v5.2.1

- **fixed** — Revert erroneous breaking change related to the extended query parser that was introduced in version 5.2.0

##### What's Changed

> [!IMPORTANT]  
> The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

* Release: 5.2.1 by @UlisesGascon in https://github.com/expressjs/express/pull/6933

**Full Changelog**: https://github.com/expressjs/express/compare/v5.2.0...v5.2.1

### v5.2.0

- Date: 2025-12-01
- Version: v5.2.0
- Original notes: https://github.com/expressjs/express/releases/tag/v5.2.0
- Permalink: https://whatsnew.fyi/product/express/releases/v5.2.0

- **security** — Fix security vulnerability CVE-2024-51999
- **deprecated** — Add deprecation warnings for redirect arguments undefined
- **changed** — Simplify acceptsLanguages implementation using spread operator
- **changed** — Use req.socket over deprecated req.connection
- **changed** — Use node protocol for querystring
- **changed** — Enforce explicit Buffer import and add lint rule
- **changed** — Use cached slice in app.listen
- **fixed** — Upgrade body-parser to 2.2.1 to address CVE-2025-13466

##### Important: Security

* Security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6))


##### What's Changed
* build(deps): bump github/codeql-action from 3.28.11 to 3.28.13 by @dependabot[bot] in https://github.com/expressjs/express/pull/6429
* Refactor: simplify `acceptsLanguages` implementation using spread operator by @Ayoub-Mabrouk in https://github.com/expressjs/express/pull/6137
* increased code coverage of utils.js file by @ashish3011 in https://github.com/expressjs/express/pull/6386
* chore: remove duplicate word by @dufucun in https://github.com/expressjs/express/pull/6456
* build(deps): bump github/codeql-action from 3.28.13 to 3.28.16 by @dependabot[bot] in https://github.com/expressjs/express/pull/6498
* build(deps): bump actions/setup-node from 4.3.0 to 4.4.0 by @dependabot[bot] in https://github.com/expressjs/express/pull/6497
* build(deps): bump actions/download-artifact from 4.2.1 to 4.3.0 by @dependabot[bot] in https://github.com/expressjs/express/pull/6496
* ci: add node.js 24 to test matrix by @Phillip9587 in https://github.com/expressjs/express/pull/6504
* ci: update codeql config by @Phillip9587 in https://github.com/expressjs/express/pull/6488
* chore: wider range for query test skip by @jonchurch in https://github.com/expressjs/express/pull/6512
* chore: fix typos in test by @noritaka1166 in https://github.com/expressjs/express/pull/6535
* ci: disable credential persistence for checkout actions by @mertssmnoglu in https://github.com/expressjs/express/pull/6522
* ci: allow manual triggering of workflow by @shivarm in https://github.com/expressjs/express/pull/6515
* test: add coverage for app.listen() variants by @kgarg1 in https://github.com/expressjs/express/pull/6476
* docs: move documentation and charters to the discussions and .github … by @bjohansebas in https://github.com/expressjs/express/pull/6427
* build(deps): bump github/codeql-action from 3.28.16 to 3.28.18 by @dependabot[bot] in https://github.com/expressjs/express/pull/6549
* build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in https://github.com/expressjs/express/pull/6548
* chore: enforce explicit `Buffer` import and add lint rule by @shivarm in https://github.com/expressjs/express/pull/6525
* chore: use node protocol for querystring by @shivarm in https://github.com/expressjs/express/pull/6520
* chore: fix typo by @mountdisk in https://github.com/expressjs/express/pull/6609
* build(deps): bump github/codeql-action from 3.28.18 to 3.29.2 by @dependabot[bot] in https://github.com/expressjs/express/pull/6618
* add deprecation warnings for redirect arguments undefined by @bjohansebas in https://github.com/expressjs/express/pull/6405
* ci: run CI when the markdown changes by @bjohansebas in https://github.com/expressjs/express/pull/6632
* doc: fix CONTRIBUTING link by @jonchurch in https://github.com/expressjs/express/pull/6653
* doc: update contributing guidelines and code of conduct links by @ShubhamOulkar in https://github.com/expressjs/express/pull/6601
* build(deps-dev): bump morgan from 1.10.0 to 1.10.1 by @dependabot[bot] in https://github.com/expressjs/express/pull/6679
* build(deps-dev): bump cookie-session from 2.1.0 to 2.1.1 by @dependabot[bot] in https://github.com/expressjs/express/pull/6678
* lint: add --fix flag to automatic fix linting issue by @shivarm in https://github.com/expressjs/express/pull/6644
* chore: ignore yarn.lock file and update example by @shivarm in https://github.com/expressjs/express/pull/6588
* lib: use req.socket over deprecated req.connection by @bjohansebas in https://github.com/expressjs/express/pull/6705
* doc: update express app example by @shivarm in https://github.com/expressjs/express/pull/6718
* build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 by @dependabot[bot] in https://github.com/expressjs

_[Truncated at 4000 characters — full notes: https://github.com/expressjs/express/releases/tag/v5.2.0]_

### 4.22.0

- Date: 2025-12-01
- Version: 4.22.0
- Original notes: https://github.com/expressjs/express/releases/tag/4.22.0
- Permalink: https://whatsnew.fyi/product/express/releases/4.22.0

- **security** — Security fix for CVE-2024-51999
- **fixed** — Method functions with no path should error
- **changed** — Update qs to 6.14.0

##### Important: Security

* Security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6))


##### What's Changed
* Refactor: improve readability by @sazk07 in https://github.com/expressjs/express/pull/6190
* ci: add support for Node.js@23.0 by @UlisesGascon in https://github.com/expressjs/express/pull/6080
* Method functions with no path should error by @wesleytodd in https://github.com/expressjs/express/pull/5957
* ci: updated github actions ci workflow by @Phillip9587 in https://github.com/expressjs/express/pull/6323
* ci: reorder `npm i` steps to fix ci for older node versions by @Phillip9587 in https://github.com/expressjs/express/pull/6336
* Backport: ci: add node.js 24 to test matrix by @Phillip9587 in https://github.com/expressjs/express/pull/6506
* chore(4.x): wider range for query test skip by @jonchurch in https://github.com/expressjs/express/pull/6513
* use tilde notation for certain dependencies by @UlisesGascon in https://github.com/expressjs/express/pull/6905
* deps: qs@6.14.0 by @UlisesGascon in https://github.com/expressjs/express/pull/6909
* deps: use tilde notation for `qs` by @Phillip9587 in https://github.com/expressjs/express/pull/6919
* Release: 4.22.0 by @UlisesGascon in https://github.com/expressjs/express/pull/6921


**Full Changelog**: https://github.com/expressjs/express/compare/4.21.2...4.22.0

### v5.1.0

- Date: 2025-03-31
- Version: v5.1.0
- Original notes: https://github.com/expressjs/express/releases/tag/v5.1.0
- Permalink: https://whatsnew.fyi/product/express/releases/v5.1.0

- **removed** — Remove Object.setPrototypeOf polyfill
- **fixed** — Use node:buffer instead of safe-buffer
- **changed** — Use loop for acceptParams
- **removed** — Replace methods dependency with standard library
- **removed** — Remove utils-merge dependency and use spread syntax instead
- **security** — Fix vulnerabilities
- **removed** — Remove unused depd dependency
- **changed** — Simplify normalizeTypes function
- **added** — Add support for ETag option in res.sendFile
- **changed** — Extend res.links() to allow adding multiple links with the same rel
- **changed** — Update body-parser to ^2.1.0
- **changed** — Update router to ^2.1.0
- **changed** — Update debug to ^4.4.0
- **changed** — Update qs to ^6.14.0
- **changed** — Update finalhandler to 2.1.0

##### What's Changed
* Update captains by @UlisesGascon in https://github.com/expressjs/express/pull/6027
* build: Node.js 23.0 by @bjohansebas in https://github.com/expressjs/express/pull/6075
* Add funding field (v5) by @bjohansebas in https://github.com/expressjs/express/pull/6064
* ✅ add discarded middleware test by @ctcpip in https://github.com/expressjs/express/pull/5819
* update homepage link http to https by @bjohansebas in https://github.com/expressjs/express/pull/5920
* Improve readme by @bjohansebas in https://github.com/expressjs/express/pull/5994
* Add bjohansebas as repo captain for expressjs.com by @crandmck in https://github.com/expressjs/express/pull/6058
* Remove Object.setPrototypeOf polyfill by @Phillip9587 in https://github.com/expressjs/express/pull/6081
* fix(buffer): use node:buffer instead of safe-buffer by @bhavya3024 in https://github.com/expressjs/express/pull/6071
* docs: Add DCO by @UlisesGascon in https://github.com/expressjs/express/pull/6048
* cleanup: remove promise support check from tests by @Phillip9587 in https://github.com/expressjs/express/pull/6148
* Use loop for acceptParams by @blakeembrey in https://github.com/expressjs/express/pull/6066
* Improve documentation step in release process by @bjohansebas in https://github.com/expressjs/express/pull/6150
* cleanup: remove unnecessary require for global Buffer by @Phillip9587 in https://github.com/expressjs/express/pull/6146
* cleanup: remove AsyncLocalStorage check by @Phillip9587 in https://github.com/expressjs/express/pull/6147
* update history.md for acceptParams change by @jonchurch in https://github.com/expressjs/express/pull/6177
* docs: add @rxmarbles to the triage team by @UlisesGascon in https://github.com/expressjs/express/pull/6151
* refactor: improve readability by @sazk07 in https://github.com/expressjs/express/pull/6173
* docs: clarify the security process in the triage role by @bjohansebas in https://github.com/expressjs/express/pull/6217
* chore: replace `methods` dependency with standard library by @jonkoops in https://github.com/expressjs/express/pull/6196
* Remove `utils-merge` dependency - use spread syntax instead by @Phillip9587 in https://github.com/expressjs/express/pull/6091
* fix(securite): fix vulnerabilities by @Abdel-Monaam-Aouini in https://github.com/expressjs/express/pull/6211
* refactor: prefix built-in node module imports by @slagiewka in https://github.com/expressjs/express/pull/6236
* fix: remove download size badges by @wesleytodd in https://github.com/expressjs/express/pull/6266
* Remove unused `depd` dependency by @jonkoops in https://github.com/expressjs/express/pull/6197
* fix: usage of `Invalid action input 'persist-credentials'` for `actions/setup-node@v4` in `ci.yml` by @hamirmahal in https://github.com/expressjs/express/pull/6256
* Add support for OSSF scorecard reporting by @UlisesGascon in https://github.com/expressjs/express/pull/5431
* docs: add @Phillip9587 to the triage team by @bjohansebas in https://github.com/expressjs/express/pull/6276
* fix: added a missing semicolon in css styles in examples/auth by @pr4j3sh in https://github.com/expressjs/express/pull/6297
* docs: include team email in the security policy by @UlisesGascon in https://github.com/expressjs/express/pull/6278
* refactor: simplify `normalizeTypes` function by @Ayoub-Mabrouk in https://github.com/expressjs/express/pull/6097
* ci: updated github actions ci workflow by @Phillip9587 in https://github.com/expressjs/express/pull/6314
* ci: fix npm install --include typo by @Phillip9587 in https://github.com/expressjs/express/pull/6324
* ci: updated scorecard actions by @Phillip9587 in https://github.com/expressjs/express/pull/6322
* build(deps): use carat notation for dependency versions by @dpopp07 in https://github.com/expressjs/express/pull/6317
* chore(deps): update `debug` to ^4.4.0 by @Phillip9587 in https://github.com/expressjs/express/pull/6313
* docs: retroactively note 5.0.0-beta.

_[Truncated at 4000 characters — full notes: https://github.com/expressjs/express/releases/tag/v5.1.0]_

### 4.21.2

- Date: 2024-12-05
- Version: 4.21.2
- Original notes: https://github.com/expressjs/express/releases/tag/4.21.2
- Permalink: https://whatsnew.fyi/product/express/releases/4.21.2

- **changed** — Update path-to-regexp to 0.1.12

##### What's Changed
* Add funding field (v4) by @bjohansebas in https://github.com/expressjs/express/pull/6065
* deps: path-to-regexp@0.1.11 by @blakeembrey in https://github.com/expressjs/express/pull/5956
* deps: bump path-to-regexp@0.1.12 by @jonchurch in https://github.com/expressjs/express/pull/6209
* Release: 4.21.2 by @UlisesGascon in https://github.com/expressjs/express/pull/6094


**Full Changelog**: https://github.com/expressjs/express/compare/4.21.1...4.21.2

### v5.0.1 — 5.0.1

- Date: 2024-10-08
- Version: v5.0.1
- Original notes: https://github.com/expressjs/express/releases/tag/v5.0.1
- Permalink: https://whatsnew.fyi/product/express/releases/v5.0.1

- **security** — Update cookie dependency semver lock to address CVE-2024-47764

##### What's Changed
* remove --bail from test script by @jonchurch in https://github.com/expressjs/express/pull/5962
* Nominate @bjohansebas to the triage team by @UlisesGascon in https://github.com/expressjs/express/pull/6009
* Link and update captains by @blakeembrey in https://github.com/expressjs/express/pull/6013
* Update `cookie` semver lock to address CVE-2024-47764 by @joshbuker in https://github.com/expressjs/express/pull/6017
* Release: 5.0.1 by @UlisesGascon in https://github.com/expressjs/express/pull/6032


**Full Changelog**: https://github.com/expressjs/express/compare/v5.0.0...5.0.1

### 4.21.1

- Date: 2024-10-08
- Version: 4.21.1
- Original notes: https://github.com/expressjs/express/releases/tag/4.21.1
- Permalink: https://whatsnew.fyi/product/express/releases/4.21.1

- **security** — Fix CVE-2024-47764

##### What's Changed
* Backport a fix for CVE-2024-47764 to the 4.x branch by @joshbuker in https://github.com/expressjs/express/pull/6029
* Release: 4.21.1 by @UlisesGascon in https://github.com/expressjs/express/pull/6031


**Full Changelog**: https://github.com/expressjs/express/compare/4.21.0...4.21.1

### 4.21.0

- Date: 2024-09-11
- Version: 4.21.0
- Original notes: https://github.com/expressjs/express/releases/tag/4.21.0
- Permalink: https://whatsnew.fyi/product/express/releases/4.21.0

- **deprecated** — Deprecate "back" magic string in redirects
- **changed** — Upgrade finalhandler to 1.3.1
- **changed** — Upgrade serve-static to 1.16.2
- **changed** — Upgrade qs to 6.13.0 to match qs in body-parser

##### What's Changed
* Deprecate `"back"` magic string in redirects by @blakeembrey in https://github.com/expressjs/express/pull/5935
* finalhandler@1.3.1 by @wesleytodd in https://github.com/expressjs/express/pull/5954
* fix(deps): serve-static@1.16.2 by @wesleytodd in https://github.com/expressjs/express/pull/5951
* Upgraded dependency qs to 6.13.0 to match qs in body-parser by @agadzinski93 in https://github.com/expressjs/express/pull/5946

##### New Contributors
* @agadzinski93 made their first contribution in https://github.com/expressjs/express/pull/5946

**Full Changelog**: https://github.com/expressjs/express/compare/4.20.0...4.21.0