This minor version upgrade for Express includes security fixes and a notable behavioral change.

Key Changes:

• Behavioral Change (Potential Breakage): Starting with version 4.20.0, the default depth for parsing URL-encoded data (via the qs library) has been reduced from Infinity to 32. This is a security enhancement to prevent potential denial-of-service attacks from deeply nested query strings. Applications that process query strings with more than 32 levels of nesting will be affected.
• Erroneous Breaking Change: Version 4.22.0 introduced a change to address a perceived vulnerability (CVE-2024-51999), which was later deemed an incorrect but breaking change and reverted in 4.22.1. This change alters how the request.query object is created when using the extended query parser.
• Security Fixes: The versions in this range include patches for various vulnerabilities, including an XSS issue in res.redirect and vulnerabilities in dependencies like cookie and path-to-regexp.

Recommendation:
Verify that your application does not rely on parsing deeply nested query string objects (more than 32 levels). Test query parsing functionality thoroughly after this upgrade.

Source: GitHub Releases

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.