--- title: Introducing Express v5: A New Era for the Node.js... description: Express v5 has officially shipped after a decade in development, marking a new era for the Node.js framework under revived project governance backed by the... canonical: https://daily.dev/posts/introducing-express-v5-a-new-era-for-the-node-js-framework-express-js-nn9ov9yab twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Introducing Express v5: A New Era for the Node.js Framework · Express.js | daily.dev og:description: Express v5 has officially shipped after a decade in development, marking a new era for the Node.js framework under revived project governance backed by the... og:url: https://daily.dev/posts/introducing-express-v5-a-new-era-for-the-node-js-framework-express-js-nn9ov9yab og:image: https://api.daily.dev/og/posts/nN9oV9yAB.png og:image:alt: Introducing Express v5: A New Era for the Node.js Framework · Express.js og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Introducing Express v5: A New Era for the Node.js Framework · Express.js **[Express.js](https://daily.dev/sources/expressjs-blog)** · 9 min read · 0 upvotes · 0 comments ## Summary Express v5 has officially shipped after a decade in development, marking a new era for the Node.js framework under revived project governance backed by the OpenJS Foundation. The release drops support for Node.js versions before v18, replaces path-to-regexp with a version that removes ReDoS vulnerabilities, changes route pattern syntax (optional params, splats, named parameters only), adds support for rejected promises in middleware, updates body-parser defaults and security mitigations, and removes long-deprecated method signatures like res.send(status, body). A detailed migration guide is available, and the release is currently tagged 'next' rather than 'latest' while the team finalizes LTS plans and a HeroDevs partnership for extended v4 support. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are the breaking changes when upgrading from Express 4 to Express 5? Express 5 drops support for Node.js versions before 18, updates path-to-regexp from 0.x to 8.x removing regex sub-expressions to prevent ReDoS attacks, changes route syntax so `:name?` becomes `{:name}` and `*` becomes `*name`, requires all route parameters to be named, and removes deprecated method signatures like `res.send(status, body)` and `res.redirect('back')`. _Track breaking changes like these on daily.dev before touching production Express code._ ### Does Express 5 support async/await error handling in middleware? Yes, Express 5 adds support for rejected promises thrown from middleware, so an async middleware function that throws (for example when a database call fails) is automatically caught by the router and treated as calling next(err), removing the need for manual try/catch in many cases. Resolved promises calling next are not supported. _Developers migrating middleware patterns follow framework changes like this on daily.dev._ ### Why did Express remove regex sub-expressions like /:foo(\\d+) in v5 routes? Express removed sub-expression regular expressions in v5 because they made it easy to accidentally write patterns with exponential-time behavior, exposing apps to regular expression denial of service (ReDoS) attacks. The recommended migration is to use a dedicated input validation library instead of embedding regex directly in route paths. _Keep up with framework security tradeoffs like this via daily.dev when hardening Node.js apps._ ## Similar posts on daily.dev - [The Node.js and Express.js Handbook for Beginners – Servers, Routes, Routers, and Views Explained](https://daily.dev/posts/the-node-js-and-express-js-handbook-for-beginners-servers-routes-routers-and-views-explained-raoqk438q) · freeCodeCamp · 22 upvotes · 2 comments - [Node.js — Node.js v22.21.1 \(LTS\)](https://daily.dev/posts/node-js-node-js-v22-21-1-lts--dpmzumpof) · Node.js · 47 upvotes · 0 comments - [July 2026 Security Releases · Express.js](https://daily.dev/posts/july-2026-security-releases-express-js-tcsj3rcgu) · Express.js · 1 upvotes · 1 comments --- Tags: [#nodejs](https://daily.dev/tags/nodejs), [#web-security](https://daily.dev/tags/web-security) [View this post on daily.dev](https://daily.dev/posts/introducing-express-v5-a-new-era-for-the-node-js-framework-express-js-nn9ov9yab) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Introducing Express v5: A New Era for the Node.js Framework · Express.js","url":"https://daily.dev/posts/introducing-express-v5-a-new-era-for-the-node-js-framework-express-js-nn9ov9yab","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/introducing-express-v5-a-new-era-for-the-node-js-framework-express-js-nn9ov9yab"},"datePublished":"2026-08-23T12:17:25.328Z","dateModified":"2026-08-23T12:24:32.675Z","description":"Express v5 has officially shipped after a decade in development, marking a new era for the Node.js framework under revived project governance backed by the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e5071d8fd95371667284db1de4695806?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e5071d8fd95371667284db1de4695806?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Express.js","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Express.js","logo":"https://media.daily.dev/image/upload/s--NvBVN7aT--/f_auto,q_auto/v1787487436/logos/expressjs-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/expressjs-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/introducing-express-v5-a-new-era-for-the-node-js-framework-express-js-nn9ov9yab","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"nodejs,web-security","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Express.js","item":"https://daily.dev/sources/expressjs-blog"},{"@type":"ListItem","position":3,"name":"Introducing Express v5: A New Era for the Node.js Framework · Express.js"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/introducing-express-v5-a-new-era-for-the-node-js-framework-express-js-nn9ov9yab#faq","mainEntity":[{"@type":"Question","name":"What are the breaking changes when upgrading from Express 4 to Express 5?","acceptedAnswer":{"@type":"Answer","text":"Express 5 drops support for Node.js versions before 18, updates path-to-regexp from 0.x to 8.x removing regex sub-expressions to prevent ReDoS attacks, changes route syntax so `:name?` becomes `{:name}` and `*` becomes `*name`, requires all route parameters to be named, and removes deprecated method signatures like `res.send(status, body)` and `res.redirect('back')`. Track breaking changes like these on daily.dev before touching production Express code."}},{"@type":"Question","name":"Does Express 5 support async/await error handling in middleware?","acceptedAnswer":{"@type":"Answer","text":"Yes, Express 5 adds support for rejected promises thrown from middleware, so an async middleware function that throws (for example when a database call fails) is automatically caught by the router and treated as calling next(err), removing the need for manual try/catch in many cases. Resolved promises calling next are not supported. Developers migrating middleware patterns follow framework changes like this on daily.dev."}},{"@type":"Question","name":"Why did Express remove regex sub-expressions like /:foo(\\\\d+) in v5 routes?","acceptedAnswer":{"@type":"Answer","text":"Express removed sub-expression regular expressions in v5 because they made it easy to accidentally write patterns with exponential-time behavior, exposing apps to regular expression denial of service (ReDoS) attacks. The recommended migration is to use a dedicated input validation library instead of embedding regex directly in route paths. Keep up with framework security tradeoffs like this via daily.dev when hardening Node.js apps."}}]} ```