Upgrading express 4 to 5
Breaking4.22.3 → 5.3.0Breaking34Security13Platform5Deprecated3New12Changed96Fixed17Other205
SecurityUpgrades qs to ^6.16.0, fixing CVE-2026-2391, CVE-2026-82417 and CVE-2026-82562.CVE-2026-2391 ↗
BreakingUpgrade verdict
33 breaking changes and 5 platform requirement changes and 11 security fixes.
In plain terms
- Removes the Object.setPrototypeOf polyfill.
- Route patterns no longer support custom regular expressions inside them, which closes a denial-of-service risk but may break existing routes.
- Code using long-deprecated Express 3 and 4 method signatures will stop working.
- Redirecting to the literal string "back" no longer sends users to the previous page; you must pass the referrer URL yourself.
Must act Top 5 of 52 that need code or config changes
express publishes an official migration guide for version 5. It covers more than the release notes do.
Migrating to Express 5 ↗Node.js requirement changed in 5.0.0: >= 0.10.0 → >= 18.
Adds mime-types ^3.0.0, once ^1.4.0, router ^2.2.0.
Drops array-flatten, methods, path-to-regexp, safe-buffer, setprototypeof, utils-merge.
Installs 67 packages in all (was 70).
What you must change
Breaking33
Removes the Object.setPrototypeOf polyfill.
Object.setPrototypeOfUpdates to path-to-regexp@8.x, removing sub-expression regex patterns for security reasons (ReDoS mitigation).
path-to-regexpRemoves old, deprecated API method signatures from Express v3/v4.
Removes
back as a magic string in res.redirect, so redirect('back') no longer resolves to the referrer.res.redirect()backreq.body is no longer always initialized to {}.req.bodyNamed matching groups are no longer available by position in
req.params.req.paramsRemoves the
debug dependency from router.debugRemoves special
* path segment behavior.*Removes the
hidden option in send; use dotfiles instead.hiddendotfilesRemoves the
path-to-regexp dependency.path-to-regexpRemoves
DEBUG_FD environment variable support from debug@3.1.0.DEBUG_FDRemoves the
res.redirect(url, status) signature; use res.redirect(status, url) instead.res.redirect()Removes the
res.send(status, body) signature; use res.status(status).send(body) instead.res.send()res.status()Removes Express 3.x middleware error stubs.
Removes the
res.json(status, obj) signature; use res.status(status).json(obj) instead.res.json()res.status()Removes the
res.jsonp(status, obj) signature; use res.status(status).jsonp(obj) instead.res.jsonp()res.status()Removes the no-argument form of
res.vary(); a field name must now be provided.res.vary()Removes
app.param(fn).app.param(fn)Removes
req.param(); use req.params, req.body, or req.query instead.req.param()req.paramsreq.bodyreq.queryThe leading
: character in name for app.param(name, fn) is no longer removed.app.param(name, fn)Removes
app.del; use app.delete instead.app.delapp.deleteRemoves
req.acceptsCharset; use req.acceptsCharsets instead.req.acceptsCharsetreq.acceptsCharsetsRemoves
req.acceptsEncoding; use req.acceptsEncodings instead.req.acceptsEncodingreq.acceptsEncodingsRemoves
req.acceptsLanguage; use req.acceptsLanguages instead.req.acceptsLanguagereq.acceptsLanguagesRemoves the
res.json(obj, status) signature; use res.json(status, obj).res.jsonRemoves the
res.jsonp(obj, status) signature; use res.jsonp(status, obj).res.jsonpRemoves the
res.send(body, status) signature; use res.send(status, body).res.sendRemoves the
res.send(status) signature; use res.sendStatus(status).res.sendres.sendStatusRemoves
res.sendfile; use res.sendFile instead.res.sendfileres.sendFileRemoves the
express.query middleware.express.queryInternalizes the private
router.process_params method.router.process_paramsMatching group expressions are only RegExp syntax.
Regular expressions can only be used in a matching group.
Security11
Upgrades qs to ^6.16.0, fixing CVE-2026-2391, CVE-2026-82417 and CVE-2026-82562.
qsarrayLimitisBufferUpgrades proxy-addr to ^2.0.8, fixing CVE-2026-90711.
proxy-addrUpgrades body-parser to ^2.3.0, fixing CVE-2026-12590; invalid limit values now throw at parser initialization.
body-parserlimitFixes security vulnerability CVE-2024-51999 (GHSA-pj86-cfqh-vqx6).
Upgrades body-parser to 2.2.1 to address CVE-2025-13466.
body-parserFixes security vulnerabilities.
Updates the cookie semver lock to address CVE-2024-47764.
cookieIncludes security fixes preventing ReDoS attacks and mitigation for CVE-2024-45590.
express vulnerable to XSS via response.redirect()
Low · CVSS 5.0Express.js Open Redirect in malformed URLs
Moderate · CVSS 6.1Hardens examples to defend from privilege elevation.
Platform5
Drops support for Node.js versions before v18.
Adopts Node.js 18 as the minimum supported version.
Adopts Node 18 as the minimum supported version.
Updates support for Node.js 18 in the CI.
Requires Node.js 4 or later.
Deprecations to plan for
Deprecated3
Adds deprecation warnings for redirect arguments that are undefined.
res.redirect()Deprecates res.clearCookie accepting options.maxAge and options.expires.
res.clearCookieoptions.maxAgeoptions.expiresDeprecates non integer status codes in v4.