TL;DR

Express now correctly parses query strings with more than 20 repeated keys, resolving an issue with large arrays in URLs (web application parameters).

Fixes Worth Knowing

Repeated keys in req.query (URL parameters) are now handled correctly, allowing for arrays larger than 20 items. This resolves inconsistencies in how indexed and standard query parameters were parsed.

TL;DR

Express has been updated to address a security vulnerability (CVE-2024-51999) and, after a brief regression, the fix has been fully reverted.

Breaking

• The initial fix for CVE-2024-51999 in v5.2.0 was reverted in v5.2.1, restoring previous behavior. (Security vulnerability fix)

New

• CVE-2025-13466 Fix: Updated body-parser to version 2.2.1 to mitigate a recently discovered security issue.

Fixes Worth Knowing

• Deprecated req.connection is replaced with req.socket for improved compatibility.
• Redirect arguments now display deprecation warnings.
• Various dependency updates improve security and stability.
• CI/CD pipeline updates for faster and more reliable builds.

Before You Upgrade

• No specific action is required, but it's recommended to review your application's redirects to prepare for the eventual removal of undefined arguments.

TL;DR

Express 4.19.0 is released, including numerous dependency updates, documentation improvements, and bug fixes to enhance stability and developer experience.

Breaking

• Non-integer status codes are now deprecated in version 4 (HTTP status codes).

New

• Root support was added to res.download() (function for sending files).
• Node.js versions 16.18, 18.12, and 19.7 are now supported in CI (Continuous Integration) testing.

Fixes Worth Knowing

• Fixed a bug related to favicons in the cookie-sessions example.
• Resolved typos and documentation inconsistencies throughout the codebase.
• Corrected issues with test timeouts and port conflicts.
• Improved JSDoc (documentation generation) clarity.

Before You Upgrade

• Review your code for usage of non-integer HTTP status codes and update them accordingly to avoid future deprecation warnings.

TL;DR

Express now includes performance improvements and stricter code standards, resulting in a more efficient and reliable web application framework.

Fixes Worth Knowing

Empty headers will no longer be incorrectly set, resolving potential issues with request/response handling.

Before You Upgrade

Ensure your code adheres to modern JavaScript standards to take full advantage of the new strict mode enforcement.