diff --git a/package.json b/package.json
index c7fe644f7..e0904530d 100644
--- a/package.json
+++ b/package.json
@@ -41,7 +41,7 @@
         "cors": "2.8.5",
         "cronosjs": "1.7.1",
         "denque": "2.1.0",
-        "express": "4.21.1",
+        "express": "4.21.2",
         "express-session": "1.18.1",
         "form-data": "4.0.0",
         "fs-extra": "11.2.0",
diff --git a/packages/node_modules/@node-red/editor-api/package.json b/packages/node_modules/@node-red/editor-api/package.json
index e58f2e9fb..7f71a5fb7 100644
--- a/packages/node_modules/@node-red/editor-api/package.json
+++ b/packages/node_modules/@node-red/editor-api/package.json
@@ -23,7 +23,7 @@
         "clone": "2.1.2",
         "cors": "2.8.5",
         "express-session": "1.18.1",
-        "express": "4.21.1",
+        "express": "4.21.2",
         "memorystore": "1.6.7",
         "mime": "3.0.0",
         "multer": "1.4.5-lts.1",
diff --git a/packages/node_modules/@node-red/runtime/package.json b/packages/node_modules/@node-red/runtime/package.json
index a160c402c..73e13f13f 100644
--- a/packages/node_modules/@node-red/runtime/package.json
+++ b/packages/node_modules/@node-red/runtime/package.json
@@ -20,7 +20,7 @@
         "@node-red/util": "4.0.5",
         "async-mutex": "0.5.0",
         "clone": "2.1.2",
-        "express": "4.21.1",
+        "express": "4.21.2",
         "fs-extra": "11.2.0",
         "json-stringify-safe": "5.0.1",
         "rfdc": "^1.3.1"
diff --git a/packages/node_modules/node-red/package.json b/packages/node_modules/node-red/package.json
index 0969024ff..56711d6ff 100644
--- a/packages/node_modules/node-red/package.json
+++ b/packages/node_modules/node-red/package.json
@@ -38,7 +38,7 @@
         "basic-auth": "2.0.1",
         "bcryptjs": "2.4.3",
         "cors": "2.8.5",
-        "express": "4.21.1",
+        "express": "4.21.2",
         "fs-extra": "11.2.0",
         "node-red-admin": "^4.0.1",
         "nopt": "5.0.0",