express

Highlights

Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header

• security

  Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer

• security

  Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711

Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

• security

  Upgrade body-parser to ^2.3.0, which fixes CVE-2026-12590 (GHSA-v422-hmwv-36x6): an invalid limit option value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalid limit values now throw at parser initialization instead of being ignored

Performance

• Avoid duplicate Content-Type header processing in res.send() when sending string responses without an explicit Content-Type header

What's Changed

• 📝 add note to history

• enhance req.acceptsCharsets method

• nominate @krzysdz to triage team

• Polish HTML structure of the response in the res.redirect() function

• do not modify the Content-Type twice when sending strings

• Allow passing null or undefined as the value for options in app.render

• search example to support Redis v4+ and Express 4/5

• Remove duplicate tests in res.location and res.jsonp

• security

  bump qs minimum to ^6.14.2 for CVE-2026-2391

• include edge case tests for res.type()

• update deprecated npm install docs URL in Readme.md

• fixed typo in history.md

• bump qs minimum to 6.15.2

• Upgrade content-type

• Improve error logging by logging full error object

• replace deprecated trimRight() with trimEnd()

• Upgrade content-disposition

• res.send: add Content-Length header only if Transfer-Encoding is not present

• allow conditional revalidation for QUERY requests

• res.send: preserve ETag generation with Transfer-Encoding