Express.js has launched version 5.0.0, marking a significant update from the previous stable 4.21.2. While both versions maintain the core promise of a fast, unopinionated web framework ideal for building robust Node.js applications, the internal architecture and dependency management have undergone notable changes. Developers will observe alterations in the dependency list, revealing a shift in how certain functionalities are handled. For instance, the send dependency jumped from version 0.19.0 to ^1.1.0 in the new release, which might indicate changes in static file serving or content delivery. Also debug updated drastically, from 2.6.9 to 4.3.6. The router dependency appeared in version 5 too, indicating changes in how routing is managed within the framework.
Conversely, some dependencies like array-flatten and path-to-regexp, present in 4.21.2, are no longer explicitly listed in 5.0.0, suggesting that these functionalities might be integrated directly into the core or replaced with alternative solutions.
The finalhandler and serve-static dependencies also show interesting updates 1.3.1 to ^2.0.0 and 1.16.2 to ^2.1.0, respectively.
Developers should carefully examine these dependency modifications when migrating, as they could impact the subtle behavior of request handling and middleware interactions. Furthermore, express-session is only a dev dependency in both versions, which is a good thing since this library has security pitfalls. This significant version bump warrants thorough testing to ensure compatibility with existing applications and to leverage any performance improvements or new features introduced. The change in fileCount and unpackedSize could be a good indicator regarding performance and size optimizations.
All the vulnerabilities related to the version 5.0.0 of the package
cookie accepts cookie name, path, and domain with out of bounds characters
The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value) would result in "userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test", setting userName cookie to <script> and ignoring value.
A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie.
Upgrade to 0.7.0, which updates the validation for name, path, and domain.
Avoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input.
