Express 5.3.0 closes a fail-open body size limit and changes three response headers

Victoria Shinder11 October 2026, 09:392 min read

Express 5.3.0 was published on 9 October. Most of its value is in the dependencies it upgrades — five CVEs across three of them — but it also changes three response headers in ways that tests asserting exact bytes will notice.

The fix to look at first: a size limit that turned itself off. Through body-parser 2.3.0, Express picks up the fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6). If the limit option of a body parser was given a value the library could not interpret, enforcement of the request-body size was silently disabled rather than rejected — a fail-open that lets a client send arbitrarily large payloads. From this release an invalid limit throws when the parser is created. That means an application with such a typo will now fail at start-up, which is the point: the configuration was never protecting it.

Two more dependency fixes:

• qs goes to ^6.16.0 for CVE-2026-2391, CVE-2026-82417 and CVE-2026-82562 — arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer.
• proxy-addr goes to ^2.0.8 for CVE-2026-90711. The release notes give the identifier without a description.

Header changes that can break tests:

• res.send() no longer adds Content-Length when a Transfer-Encoding header is already set, because HTTP says the two should not appear together. ETag generation is unaffected.
• content-type 2.0 makes res.send() keep existing parameters when it appends the charset — text/plain; foo=bar becomes text/plain; foo=bar; charset=utf-8 — and it no longer throws on a Content-Type it cannot parse. The release credits the new parser with roughly 1.5× faster parsing and formatting.
• content-disposition 2.0 stops quoting file names that are valid HTTP tokens: res.attachment('user.html') now emits filename=user.html instead of filename="user.html". RFC 6266 treats the two as equivalent; snapshot tests do not.

Smaller behaviour changes. req.fresh now covers the QUERY method, so a QUERY response with a matching If-None-Match can return 304 — the release notes describe QUERY as safe, idempotent and cacheable. The default error handler logs the whole error object instead of only its stack, so Error.cause and library-specific fields stop disappearing from logs. app.render(view, null, cb) now behaves like an omitted options object, and HTML bodies produced by res.redirect() gain a doctype, title and body.

What to do. Upgrade, then search your code for limit: in body-parser options and check each value against the body-parser documentation; an invalid one will now stop the app from starting. If your test suite compares Content-Type or Content-Disposition strings byte for byte, expect diffs and decide whether they matter before updating snapshots.

Source: Express v5.3.0 release notes, 9 October 2026 — https://github.com/expressjs/express/releases/tag/v5.3.0 ; body-parser advisory — https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6