diff --git a/package.json b/package.json
index d09aa1378..137849ef6 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,7 @@
         "cors": "2.8.5",
         "cronosjs": "1.7.1",
         "denque": "2.1.0",
-        "express": "4.21.2",
+        "express": "4.22.1",
         "express-session": "1.18.2",
         "form-data": "4.0.4",
         "fs-extra": "11.3.0",
diff --git a/packages/node_modules/@node-red/editor-api/package.json b/packages/node_modules/@node-red/editor-api/package.json
index b0f29491b..fdff50fe2 100644
--- a/packages/node_modules/@node-red/editor-api/package.json
+++ b/packages/node_modules/@node-red/editor-api/package.json
@@ -23,7 +23,7 @@
         "clone": "2.1.2",
         "cors": "2.8.5",
         "express-session": "1.18.2",
-        "express": "4.21.2",
+        "express": "4.22.1",
         "memorystore": "1.6.7",
         "mime": "3.0.0",
         "multer": "2.0.2",
diff --git a/packages/node_modules/@node-red/runtime/package.json b/packages/node_modules/@node-red/runtime/package.json
index 40aca07aa..5ebd2f60b 100644
--- a/packages/node_modules/@node-red/runtime/package.json
+++ b/packages/node_modules/@node-red/runtime/package.json
@@ -21,7 +21,7 @@
         "async-mutex": "0.5.0",
         "clone": "2.1.2",
         "cronosjs": "1.7.1",
-        "express": "4.21.2",
+        "express": "4.22.1",
         "fs-extra": "11.3.0",
         "got": "12.6.1",
         "json-stringify-safe": "5.0.1",
diff --git a/packages/node_modules/node-red/package.json b/packages/node_modules/node-red/package.json
index e85deba92..915f403fb 100644
--- a/packages/node_modules/node-red/package.json
+++ b/packages/node_modules/node-red/package.json
@@ -38,7 +38,7 @@
         "basic-auth": "2.0.1",
         "bcryptjs": "3.0.2",
         "cors": "2.8.5",
-        "express": "4.21.2",
+        "express": "4.22.1",
         "fs-extra": "11.3.0",
         "node-red-admin": "^4.1.2",
         "nopt": "5.0.0",