v5.2.1

expressjs/expressv5.2.1Dec 1, 2025by jonchurch

AI Summary

This patch release reverts an erroneous breaking change that was included in v5.2.0 related to the extended query parser. The CVE-2024-51999 was rejected as there is no actual security vulnerability associated with the behavior. This release fully reverts that change to restore previous functionality.

Key Highlights

Reverts erroneous breaking change from v5.2.0
CVE-2024-51999 has been rejected - no actual security vulnerability
Restores previous extended query parser behavior

Full Release Notes

## What's Changed

> [!IMPORTANT]  
> The prior release (5.2.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

* Release: 5.2.1 by @UlisesGascon in https://github.com/expressjs/express/pull/6933

**Full Changelog**: https://github.com/expressjs/express/compare/v5.2.0...v5.2.1