Sourced from express's releases.
v4.22.2
What's Changed
- fix: restore >20 array parsing for
req.queryrepeated keys (8d09bfe6)
- This also unifies array-cap behavior across notations. Indexed notation (
a[0]=...) was historically capped at qs's defaultarrayLimitof 20 even in older qs versions; after this change it also allows up to 1000 items.- deps: qs@~6.15.1
- deps: body-parser@~1.20.5
New Contributors
@suuuuuuminnnnnnmade their first contribution in expressjs/express#7021@SAY-5made their first contribution in expressjs/express#7181Full Changelog: https://github.com/expressjs/express/compare/v4.22.1...v4.22.2
v4.22.1
What's Changed
[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.
- Release: 4.22.1 by
@UlisesGasconin expressjs/express#6934Full Changelog: https://github.com/expressjs/express/compare/4.22.0...v4.22.1
4.22.0
Important: Security
- Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
What's Changed
- Refactor: improve readability by
@sazk07in expressjs/express#6190- ci: add support for Node.js@23.0 by
@UlisesGasconin expressjs/express#6080- Method functions with no path should error by
@wesleytoddin expressjs/express#5957- ci: updated github actions ci workflow by
@Phillip9587in expressjs/express#6323- ci: reorder
npm isteps to fix ci for older node versions by@Phillip9587in expressjs/express#6336- Backport: ci: add node.js 24 to test matrix by
@Phillip9587in expressjs/express#6506- chore(4.x): wider range for query test skip by
@jonchurchin expressjs/express#6513- use tilde notation for certain dependencies by
@UlisesGasconin expressjs/express#6905- deps: qs@6.14.0 by
@UlisesGasconin expressjs/express#6909- deps: use tilde notation for
qsby@Phillip9587in expressjs/express#6919- Release: 4.22.0 by
@UlisesGasconin expressjs/express#6921Full Changelog: https://github.com/expressjs/express/compare/4.21.2...4.22.0
Sourced from express's changelog.
4.22.2 / 2026-05-011
- fix: restore >20 array parsing for
req.queryrepeated keys (8d09bfe6)
- This also unifies array-cap behavior across notations. Indexed notation (
a[0]=...) was historically capped at qs's defaultarrayLimitof 20 even in older qs versions; after this change it also allows up to 1000 items.- deps: qs@~6.15.1
- deps: body-parser@~1.20.5
4.22.1 / 2025-12-01
- Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
- The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.
4.22.0 / 2025-12-01
- Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
- deps: use tilde notation for dependencies
- deps: qs@6.14.0
df0abc9
4.22.2836d366
4.x update qs to 6.15.1, body-parser 1.20.5 (#7224)8d09bfe
fix: restore array parsing for req.query repeated keys (#7181)d39e8ad
deps: body-parser@~1.20.4 (#7021)efe85d9
deps: qs@^6.14.1 (#6972)f62378e
📝 add note to history12fae14
4.22.15ddf311
Revert "sec: security patch for CVE-2024-51999"49744ab
4.22.0 (#6921)6e97452
sec: security patch for CVE-2024-51999