npm / express
express
What changed in express 4 to 5, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
3 breaking4 security1 deprecations4 behavior and defaults5 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initexpress 515 changes
Breaking changes 2
Invalid limit values now throw during parser initialization instead of being ignored, preventing request body size enforcement from being silently disabled.
Valid HTTP-token file names are no longer quoted in the Content-Disposition header; applications asserting exact header bytes may need to update expectations.
Security 4
Upgraded to fix CVE-2026-90711.
Upgraded to fix arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer.
body-parser was upgraded to 2.2.1 to address CVE-2025-13466.
A security fix addresses CVE-2024-51999.
Deprecations 1
Deprecation warnings are now emitted for redirect arguments that are undefined.
Behavior and default changes 3
Now logs the full error object instead of only its stack trace, retaining nested details such as Error.cause and library-specific properties.
Freshness validation now includes QUERY requests, allowing matching conditional validators to produce 304 responses.
HTML-format redirect responses now include a doctype, title, and body for better browser compatibility.
Fixes and other changes 5
Passing null as options now handles the locals object correctly and behaves like omitting options or passing an empty object.
Only adds Content-Length when Transfer-Encoding is absent, preventing conflicting response headers; ETag generation is unaffected by Transfer-Encoding.
When adding a charset, existing Content-Type parameters are preserved, and a Content-Type that fails to parse no longer throws.
Avoids duplicate Content-Type header processing when sending string responses without an explicit Content-Type header.
The breaking change to the extended query parser introduced in 5.2.0 was fully reverted.
express 42 changes
Breaking changes 1
Method functions called without a path now error.
Behavior and default changes 1
Repeated-key arrays can contain more than 20 items, and indexed notation now allows up to 1000 items, unifying array-cap behavior across notations.