express

express (latest known version: 5.2.1) has 16 known breaking changes on record, each backed by a source URL.

Actively maintainedLatest known version: 5.2.1npm ↗

Security advisories

GHSA-cm5g-3pgc-8rg4MODERATE<4.0.0-rc1

Express ressource injection

GHSA-gpvr-g6gh-9mc2MODERATE<3.11.0 || >=4.0.0 <4.5.0

No Charset in Content-Type Header in express

GHSA-jj78-5fmv-mv28LOW>=3.4.5 <4.0.0-rc1

Express Open Redirect vulnerability

GHSA-qw6h-vgh9-j6wxLOW<4.20.0 || >=5.0.0-alpha.1 <5.0.0

express vulnerable to XSS via response.redirect()

GHSA-rv95-896h-c2vcMODERATE<4.19.2 || >=5.0.0-alpha.1 <5.0.0-beta.3

Express.js Open Redirect in malformed URLs

Recent changes

v5.0.0Breaking

Version 5.0.0 is a semver-major release over 4.22.2, but no breaking change was detected in the release notes text - flagged for manual review.

v4.9.4Breaking

Fix issue with object keys starting with numbers being truncated

Update qs dependency to version 2.2.4 or later

v4.9.3Security

Fix a global leak when multiple subnets are trusted in proxy-addr dependency

v4.9.2Notable

Improve error message for bad `app.use` arguments

v4.9.2Notable

Fix `router.use` to accept array of middleware without path

v4.9.2Breaking

Fix regression for empty string `path` in `app.use` - empty string paths that previously worked are now accepted again

v4.9.1Notable

Fix `app.use` to accept array of middleware without path

v4.9.0Security

Set `X-Content-Type-Options: nosniff` header in finalhandler

v4.9.0Notable

vary@~1.0.0: Accept valid `Vary` header string as `field`

v4.9.0Notable

type-is@~1.5.1: fix `hasbody` to be true for `content-length: 0`

v4.9.0Notable

qs@2.2.3: Fix issue where first empty value in array is discarded

v4.9.0Notable

Add `lastModified` option in send and serve-static

v4.9.0Notable

Use `etag` to generate `ETag` headers

v4.9.0Notable

Support IP address host in `req.subdomains`

v4.9.0Notable

Invoke callback for sendfile when client aborts - applies to `res.sendFile`, `res.sendfile`, and `res.download` with `err` populated with request aborted error

v4.9.0Notable

Add `res.sendStatus`

v4.9.0Breaking

media-typer@0.3.0: Throw error when parameter format invalid on parse

Ensure your code handles errors when parsing media types with invalid parameter formats

v4.8.8Security

Fix malicious path detection for empty string path

v4.8.8Security

Fix a path traversal issue when using `root`

v4.8.7Notable

Updated qs dependency to version 2.2.2 which removes unnecessary cloning

v4.8.6Notable

deps: qs@2.2.0 with array parsing fix and performance improvements

v4.8.4Security

Work around `fd` leak in Node.js 0.10 for `fs.ReadStream`

v4.8.4Notable

deps: serve-static@~1.5.2

v4.8.4Notable

deps: send@0.8.2

v4.8.4Notable

deps: qs@1.2.2

v4.8.3Notable

Updated utils-merge to 1.0.0 in serve-static

v4.8.3Notable

Fixed parsing of weird req.originalUrl values in serve-static

v4.8.3Notable

Updated serve-static to ~1.5.1

v4.8.3Notable

Updated qs to 1.2.1

v4.8.3Notable

Updated parseurl to ~1.3.0

Check what changed for express since your installed version, live.

Open the playground →