Four Express 5 changes touch security: express.urlencoded no longer uses the extended parser by default, the query parser default moved from extended to simple, express.static ignores dotfiles by default, and req.query is now read only. Express 5 also needs Node.js 18 or higher.
Why version support matters first
The Express support page lists v5.x as supported from September 2024 with no end date, and v4.x as supported with no end date. It lists v3.x as ended in July 2015 and v2.x as ended in July 2012. The page also says only the latest version of a given major line is supported, and that end of life versions may get critical fixes but with no guarantee.
So there is no emergency on 4.x today, but you must be on the latest 4.x release, and the supported pair is 4 and 5. Anything older is unmaintained.
The changes, one by one
| Area | Express 4 behavior | Express 5 behavior |
|---|---|---|
| express.urlencoded | extended parsing | extended is false by default |
| Query string parser | extended | simple |
| express.static dotfiles | served | ignored by default |
| req.query | writable | getter, not writable |
| Minimum Node.js | older | 18 or higher |
All five rows come from the official migration guide.
Why each one matters
Extended versus simple parsing. Extended mode builds nested objects and arrays from keys like a[b][c]=1. Simple mode does not. Less structure means fewer surprises, and a smaller attack surface for code that merges query data into other objects. If your code relies on nested query or form data, you must now opt in explicitly, which makes the risky behavior visible in review.
Dotfiles. Express 4 served files inside directories starting with a dot. The guide notes this means a .well-known directory is no longer accessible by default in Express 5, so you must allow it deliberately for things like certificate challenges. The security gain is that stray .env or .git content in a static folder is no longer served by default. Still, never put such files in a public directory.
Read only req.query. Code that assigned to req.query as a place to stash cleaned input will fail. Use a separate variable, or your own property, for sanitized values.
Steps for a safe upgrade
- Move to Node.js 18 or higher, ideally a current LTS. See which Node.js version to run in production.
- Run the codemod the migration guide suggests for explicit request params, then run your tests.
- Add tests for nested query strings and form bodies, since parsing differences are silent.
- Search for static directories and confirm you do not rely on dotfile serving.
- Re-run your dependency scan after the bump, because middleware packages have their own versions.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the inventory and look at how many middleware packages sit under a single framework dependency.
Safeguard's SBOM and dependency scanning inventories the packages your Express app resolves, and reachability analysis helps show which advisories your code can actually hit. Free scan: gold.safeguard.sh/scan.
Quick check
Is Express 4 end of life?
Per the Express support page, v4.x has support ongoing alongside v5.x. Only the latest release of each major line is supported, so keep 4.x current.
Will my urlencoded forms break on Express 5?
Only if they depend on nested keys. If so, set extended to true explicitly, or better, flatten the form fields.
Sources
Last reviewed: 19 October 2026.
