Express

Express 5.3.0 fixes a Content-Length/Transfer-Encoding header conflict in res.send, patches multiple dependency CVEs (qs, proxy-addr, body-parser) including a fail-open denial-of-service bug in body-parser's limit option, and extends conditional freshness checks to QUERY requests. The content-disposition upgrade changes res.download/res.attachment/res.sendFile output so valid HTTP token filenames are no longer quoted, and body-parser now throws on invalid limit values instead of silently disabling size enforcement, so apps asserting exact header bytes or relying on invalid limit configs must update their code.

Matters for: Relevant for teams running Express apps in production that parse untrusted request bodies or query strings, or that assert on exact Content-Disposition header formatting in automated tests.

Express 4.22.3 updates path-to-regexp to 0.1.13, fixing CVE-2026-4867, and bumps the qs dependency to ~6.16.0, plus adds conditional revalidation support for QUERY requests.

Matters for: Teams running Express 4.x in production who need to patch known CVEs without upgrading to Express 5.