Highlights

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @davetashner in #7057 and #7478, and @cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

• Upgrade body-parser to ^2.3.0, which fixes CVE-2026-12590 (GHSA-v422-hmwv-36x6): an invalid limit option value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalid limit values now throw at parser initialization instead of being ignored - by @Mayvis in #7390

⚡ Performance

• Avoid duplicate Content-Type header processing in res.send() when sending string responses without an explicit Content-Type header - by @bjohansebas in #6991

What's Changed

• 📝 add note to history by @ctcpip in #6946
• docs: add @rxmarbles to triagers by @rxmarbles in #6953
• docs: use global Security policy by @UlisesGascon in #6570
• doc: fix security.md link to point to security tab by @jonchurch in #6976
• build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in #6961
• fix: enhance req.acceptsCharsets method by @Abdel-Monaam-Aouini in #6088
• build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in #6965
• build(deps): bump github/codeql-action from 4.31.6 to 4.31.9 by @dependabot[bot] in #6964
• fix(deps): update version lib qs by @gabrieel1007 in #6969
• build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #6963
• build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by @dependabot[bot] in #6962
• nominate @krzysdz to triage team by @bjohansebas in #6482
• Polish HTML structure of the response in the res.redirect() function by @Bernice55231 in #5167
• docs: fix JSDoc for req.accepts() return value and parameter format by @marcosmol204 in #6936
• test: added unit tests for utils.compileETag to cover valid and invalid inputs by @sukdev24 in #6534
• chore: remove benchmarks directory by @bjohansebas in #6992
• feat: do not modify the Content-Type twice when sending strings by @bjohansebas in #6991
• feat: Allow passing null or undefined as the value for options in app.render by @AkaHarshit in #6903
• test: add test for normalizeType fallback when mime lookup fails by @Ayoub-Mabrouk in #6894
• fix: search example to support Redis v4+ and Express 4/5 by @vinybrun in #6274
• docs: Add @GroophyLifefor to the triage team by @bjohansebas in #6995
• build(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in #7011
• build(deps): bump actions/setup-node from 6.1.0 to 6.2.0 by @dependabot[bot] in #7012
• build(deps): bump github/codeql-action from 4.31.9 to 4.32.0 by @dependabot[bot] in #7013
• Remove duplicate tests in res.location and res.jsonp by @GroophyLifefor in #6996
• fix: bump qs minimum to ^6.14.2 for CVE-2026-2391 by @davetashner in #7057
• docs: fix README security policy by @pavan-sh in #7029
• include edge case tests for res.type() by @IshitaSingh0822 in #7037
• build(deps): bump github/codeql-action from 4.32.0 to 4.32.4 by @dependabot[bot] in #7072
• build(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 by @dependabot[bot] in #7073
• build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in #7074
• docs: replace dummy with placeholder in example comments by @samtuckerdavis in #7064
• docs: remove dead link from Readme by @ayushshukla1807 in #7136
• fix: update deprecated npm install docs URL in Readme.md by @Vansh1811 in #7159
• build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 ...

What's Changed

• fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
  • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
• deps: qs@~6.15.1
• deps: body-parser@~1.20.5

New Contributors

• @suuuuuuminnnnnn made their first contribution in #7021
• @SAY-5 made their first contribution in #7181

Full Changelog: v4.22.1...v4.22.2

What's Changed

• Release: 5.2.1 by @UlisesGascon in #6933

Full Changelog: v5.2.0...v5.2.1

Important: Security

• Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

What's Changed

• build(deps): bump github/codeql-action from 3.28.11 to 3.28.13 by @dependabot[bot] in #6429
• Refactor: simplify acceptsLanguages implementation using spread operator by @Ayoub-Mabrouk in #6137
• increased code coverage of utils.js file by @ashish3011 in #6386
• chore: remove duplicate word by @dufucun in #6456
• build(deps): bump github/codeql-action from 3.28.13 to 3.28.16 by @dependabot[bot] in #6498
• build(deps): bump actions/setup-node from 4.3.0 to 4.4.0 by @dependabot[bot] in #6497
• build(deps): bump actions/download-artifact from 4.2.1 to 4.3.0 by @dependabot[bot] in #6496
• ci: add node.js 24 to test matrix by @Phillip9587 in #6504
• ci: update codeql config by @Phillip9587 in #6488
• chore: wider range for query test skip by @jonchurch in #6512
• chore: fix typos in test by @noritaka1166 in #6535
• ci: disable credential persistence for checkout actions by @mertssmnoglu in #6522
• ci: allow manual triggering of workflow by @shivarm in #6515
• test: add coverage for app.listen() variants by @kgarg1 in #6476
• docs: move documentation and charters to the discussions and .github … by @bjohansebas in #6427
• build(deps): bump github/codeql-action from 3.28.16 to 3.28.18 by @dependabot[bot] in #6549
• build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in #6548
• chore: enforce explicit Buffer import and add lint rule by @shivarm in #6525
• chore: use node protocol for querystring by @shivarm in #6520
• chore: fix typo by @mountdisk in #6609
• build(deps): bump github/codeql-action from 3.28.18 to 3.29.2 by @dependabot[bot] in #6618
• add deprecation warnings for redirect arguments undefined by @bjohansebas in #6405
• ci: run CI when the markdown changes by @bjohansebas in #6632
• doc: fix CONTRIBUTING link by @jonchurch in #6653
• doc: update contributing guidelines and code of conduct links by @ShubhamOulkar in #6601
• build(deps-dev): bump morgan from 1.10.0 to 1.10.1 by @dependabot[bot] in #6679
• build(deps-dev): bump cookie-session from 2.1.0 to 2.1.1 by @dependabot[bot] in #6678
• lint: add --fix flag to automatic fix linting issue by @shivarm in #6644
• chore: ignore yarn.lock file and update example by @shivarm in #6588
• lib: use req.socket over deprecated req.connection by @bjohansebas in #6705
• doc: update express app example by @shivarm in #6718
• build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 by @dependabot[bot] in #6675
• Remove history.md from being packaged on publish by @sheplu in #6780
• build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in #6797
• build(deps): bump github/codeql-action from 3.29.7 to 3.30.5 by @dependabot[bot] in #6796
• build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #6795
• build(deps): bump actions/setup-node from 4.4.0 to 5.0.0 by @dependabot[bot] in #6794
• build(deps): bump actions/download-artifact from 4.3.0 to 5.0.0 by @dependabot[bot] in #6793
• ci: add node.js 25 to test matrix by @Phillip9587 in #6843
• build(deps): bump actions/download-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in #6871
• build(deps): bump actions/setup-node from 5.0.0 to 6.0.0 by @dependabot[bot] in #6870
• build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 by @dependabot[bot] in #6869
• build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in #6868
• chore: switch badges from badgen.net to shields.io by @Phillip9587 in #6900
• refactor: use cached slice in app.listen by @Tacit1 in #6897
• Nominate to @efekrskl for triage team by @bjohansebas in #6888
• docs: update emeritus triagers by @bjohansebas in #6890
• fix: upgrade body-parser to 2.2.1 to address CVE-2025-13466 by @shivarm in #6922
• build(deps): bump coverallsapp/github-action from 2.3.6 to 2.3.7 by @dependabot[bot] in #6930
• build(deps): bump github/codeql-action from 4.31.2 to 4.31.6 by @dependabot[bot] in #6929
• build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in #6928
• Release: 5.2.0 by @UlisesGascon in #6920

New Contributors

• @ashish3011 made their first contribution in #6386
• @dufucun made their first contribution in #6456
• @noritaka1166 made their first contribution in #6535
• @mertssmnoglu made their first contribution in #6522
• @shivarm made their first contribution in #6515
• @kgarg1 made their first contribution in #6476
• @mountdisk made their first contribution in #6609
• @ShubhamOulkar made their first contribution in #6601
• @sheplu made their first contribution in #6780
• @Tacit1 made their first contribution in #6897

Full Changelog: v5.1.0...v5.2.0

What's Changed

• Release: 4.22.1 by @UlisesGascon in #6934

Full Changelog: 4.22.0...v4.22.1

Important: Security

• Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

What's Changed

• Refactor: improve readability by @sazk07 in #6190
• ci: add support for Node.js@23.0 by @UlisesGascon in #6080
• Method functions with no path should error by @wesleytodd in #5957
• ci: updated github actions ci workflow by @Phillip9587 in #6323
• ci: reorder npm i steps to fix ci for older node versions by @Phillip9587 in #6336
• Backport: ci: add node.js 24 to test matrix by @Phillip9587 in #6506
• chore(4.x): wider range for query test skip by @jonchurch in #6513
• use tilde notation for certain dependencies by @UlisesGascon in #6905
• deps: qs@6.14.0 by @UlisesGascon in #6909
• deps: use tilde notation for qs by @Phillip9587 in #6919
• Release: 4.22.0 by @UlisesGascon in #6921

Full Changelog: 4.21.2...4.22.0

What's Changed

• remove --bail from test script by @jonchurch in #5962
• Nominate @bjohansebas to the triage team by @UlisesGascon in #6009
• Link and update captains by @blakeembrey in #6013
• Update cookie semver lock to address CVE-2024-47764 by @joshbuker in #6017
• Release: 5.0.1 by @UlisesGascon in #6032

Full Changelog: v5.0.0...5.0.1

What's Changed

• Update captains by @UlisesGascon in #6027
• build: Node.js 23.0 by @bjohansebas in #6075
• Add funding field (v5) by @bjohansebas in #6064
• ✅ add discarded middleware test by @ctcpip in #5819
• update homepage link http to https by @bjohansebas in #5920
• Improve readme by @bjohansebas in #5994
• Add bjohansebas as repo captain for expressjs.com by @crandmck in #6058
• Remove Object.setPrototypeOf polyfill by @Phillip9587 in #6081
• fix(buffer): use node:buffer instead of safe-buffer by @bhavya3024 in #6071
• docs: Add DCO by @UlisesGascon in #6048
• cleanup: remove promise support check from tests by @Phillip9587 in #6148
• Use loop for acceptParams by @blakeembrey in #6066
• Improve documentation step in release process by @bjohansebas in #6150
• cleanup: remove unnecessary require for global Buffer by @Phillip9587 in #6146
• cleanup: remove AsyncLocalStorage check by @Phillip9587 in #6147
• update history.md for acceptParams change by @jonchurch in #6177
• docs: add @rxmarbles to the triage team by @UlisesGascon in #6151
• refactor: improve readability by @sazk07 in #6173
• docs: clarify the security process in the triage role by @bjohansebas in #6217
• chore: replace methods dependency with standard library by @jonkoops in #6196
• Remove utils-merge dependency - use spread syntax instead by @Phillip9587 in #6091
• fix(securite): fix vulnerabilities by @Abdel-Monaam-Aouini in #6211
• refactor: prefix built-in node module imports by @slagiewka in #6236
• fix: remove download size badges by @wesleytodd in #6266
• Remove unused depd dependency by @jonkoops in #6197
• fix: usage of Invalid action input 'persist-credentials' for actions/setup-node@v4 in ci.yml by @hamirmahal in #6256
• Add support for OSSF scorecard reporting by @UlisesGascon in #5431
• docs: add @Phillip9587 to the triage team by @bjohansebas in #6276
• fix: added a missing semicolon in css styles in examples/auth by @pr4j3sh in #6297
• docs: include team email in the security policy by @UlisesGascon in #6278
• refactor: simplify normalizeTypes function by @Ayoub-Mabrouk in #6097
• ci: updated github actions ci workflow by @Phillip9587 in #6314
• ci: fix npm install --include typo by @Phillip9587 in #6324
• ci: updated scorecard actions by @Phillip9587 in #6322
• build(deps): use carat notation for dependency versions by @dpopp07 in #6317
• chore(deps): update debug to ^4.4.0 by @Phillip9587 in #6313
• docs: retroactively note 5.0.0-beta.1 api change in history file by @dpopp07 in #6333
• feat(deps): body-parser@^2.1.0 by @wesleytodd in #6332
• feat(deps): router@^2.1.0 by @wesleytodd in #6331
• Update repo captains by @UlisesGascon in #6234
• deps: upgrade nyc by @agungjati in #6122
• fix (deps): update deps by @wesleytodd in #6337
• response: add support for ETag option in res.sendFile by @juanarbol in #6073
• Update multiple links to use https instead of http by @Phillip9587 in #6338
• Extend res.links() to allow adding multiple links with the same rel #2729 by @andvea in #4885
• docs: update emeritus triagers by @UlisesGascon in #6345
• docs: update guidance for triager nominations by @bjohansebas in #6349
• docs: clarify guidelines for becoming a committer by @bjohansebas in #6364
• Nominate @dpopp07 to the triage team by @UlisesGascon in #6352
• fix(deps): qs@^6.14.0 by @wesleytodd in #6374
• Add dependabot by @UlisesGascon in #5435
• fix dependabot config by @bjohansebas in #6392
• build(deps): bump github/codeql-action from 3.24.7 to 3.28.11 by @dependabot in #6398
• build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.1 by @dependabot in #6397
• feat(deps): finalhandler@2.1.0 by @wesleytodd in #6373
• build(deps-dev): bump cookie-session from 2.0.0 to 2.1.0 by @dependabot in #6399
• deps: body-parser@^2.2.0 by @UlisesGascon in #6419
• deps: type-is@^2.0.1 by @UlisesGascon in #6420
• deps: router@^2.2.0 by @UlisesGascon in #6417
• ci: use full SHAs for github action versions by @Phillip9587 in #6415
• doc: remove @mertcanaltin from Triagers by @mertcanaltin in #6408
• deps: serve-static@^2.2.0 by @UlisesGascon in #6418
• 5.1.0 by @wesleytodd in #6425

New Contributors

• @bhavya3024 made their first contribution in #6071
• @jonkoops made their first contribution in #6196
• @Abdel-Monaam-Aouini made their first contribution in #6211
• @slagiewka made their first contribution in #6236
• @hamirmahal made their first contribution in #6256
• @pr4j3sh made their first contribution in #6297
• @Ayoub-Mabrouk made their first contribution in #6097
• @dpopp07 made their first contribution in #6317
• @agungjati made their first contribution in #6122
• @andvea made their first contribution in #4885
• @dependabot made their first contribution in #6398

Full Changelog: 5.0.1...v5.1.0

What's Changed

• Add funding field (v4) by @bjohansebas in #6065
• deps: path-to-regexp@0.1.11 by @blakeembrey in #5956
• deps: bump path-to-regexp@0.1.12 by @jonchurch in #6209
• Release: 4.21.2 by @UlisesGascon in #6094

Full Changelog: 4.21.1...4.21.2

What's Changed

• Backport a fix for CVE-2024-47764 to the 4.x branch by @joshbuker in #6029
• Release: 4.21.1 by @UlisesGascon in #6031

Full Changelog: 4.21.0...4.21.1