diff --git a/examples/express-composition/package.json b/examples/express-composition/package.json
index a415723b2eab..f501246ae97b 100644
--- a/examples/express-composition/package.json
+++ b/examples/express-composition/package.json
@@ -53,7 +53,7 @@
     "@loopback/rest": "^15.0.12",
     "@loopback/rest-explorer": "^8.0.12",
     "@loopback/service-proxy": "^8.0.11",
-    "express": "^4.22.1",
+    "express": "^4.22.2",
     "tslib": "^2.8.1"
   },
   "devDependencies": {
diff --git a/examples/lb3-application/package.json b/examples/lb3-application/package.json
index b13da1d9549e..3864d51bcbc9 100644
--- a/examples/lb3-application/package.json
+++ b/examples/lb3-application/package.json
@@ -56,7 +56,7 @@
     "compression": "^1.8.1",
     "cors": "^2.8.6",
     "debug": "^4.4.3",
-    "express": "^4.22.1",
+    "express": "^4.22.2",
     "helmet": "^4.6.0",
     "loopback": "^3.28.0",
     "loopback-boot": "^3.3.1",
diff --git a/examples/passport-login/package.json b/examples/passport-login/package.json
index ce579090fb43..5a182d5a140b 100644
--- a/examples/passport-login/package.json
+++ b/examples/passport-login/package.json
@@ -71,7 +71,7 @@
     "body-parser": "^2.2.2",
     "client-sessions": "^0.8.0",
     "debug": "^4.4.3",
-    "express": "^4.22.1",
+    "express": "^4.22.2",
     "express-session": "^1.19.0",
     "lodash": "^4.18.1",
     "passport": "^0.7.0",
diff --git a/examples/rpc-server/package.json b/examples/rpc-server/package.json
index e8189af3d38f..f6a8ffa3df4e 100644
--- a/examples/rpc-server/package.json
+++ b/examples/rpc-server/package.json
@@ -43,7 +43,7 @@
   },
   "dependencies": {
     "@loopback/core": "^7.0.11",
-    "express": "^4.22.1",
+    "express": "^4.22.2",
     "tslib": "^2.8.1"
   },
   "devDependencies": {
diff --git a/extensions/authentication-passport/package.json b/extensions/authentication-passport/package.json
index 6207f19e93e5..eb44c8098dbb 100644
--- a/extensions/authentication-passport/package.json
+++ b/extensions/authentication-passport/package.json
@@ -68,7 +68,7 @@
     "@types/qs": "^6.15.1",
     "axios": "^1.16.0",
     "body-parser": "^2.2.2",
-    "express": "^4.22.1",
+    "express": "^4.22.2",
     "form-data": "^4.0.5",
     "jsonwebtoken": "^9.0.3",
     "lodash": "^4.18.1",
diff --git a/extensions/graphql/package.json b/extensions/graphql/package.json
index 257492bb4765..9576dcee7e84 100644
--- a/extensions/graphql/package.json
+++ b/extensions/graphql/package.json
@@ -50,7 +50,7 @@
     "body-parser": "^2.2.2",
     "cors": "^2.8.6",
     "debug": "^4.4.3",
-    "express": "^4.22.1",
+    "express": "^4.22.2",
     "graphql": "^16.14.0",
     "graphql-ws": "^5.16.2",
     "type-graphql": "^2.0.0-rc.2",
diff --git a/extensions/metrics/package.json b/extensions/metrics/package.json
index dd18c5df37c3..d85671d9c12d 100644
--- a/extensions/metrics/package.json
+++ b/extensions/metrics/package.json
@@ -54,6 +54,6 @@
     "@loopback/testlab": "^8.0.11",
     "@types/express": "^4.17.25",
     "@types/node": "^20.19.40",
-    "express": "^4.22.1"
+    "express": "^4.22.2"
   }
 }
diff --git a/fixtures/mock-oauth2-provider/package.json b/fixtures/mock-oauth2-provider/package.json
index 38f82fee343c..a93fcb878cf5 100644
--- a/fixtures/mock-oauth2-provider/package.json
+++ b/fixtures/mock-oauth2-provider/package.json
@@ -42,7 +42,7 @@
     "@types/node": "^20.19.40",
     "axios": "^1.16.0",
     "body-parser": "^2.2.2",
-    "express": "^4.22.1",
+    "express": "^4.22.2",
     "form-data": "^4.0.5",
     "jsonwebtoken": "^9.0.3",
     "lodash": "^4.18.1",
diff --git a/package-lock.json b/package-lock.json
index 1f31b566a68c..a08148fb6d38 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -522,7 +522,7 @@
         "@loopback/rest": "^15.0.12",
         "@loopback/rest-explorer": "^8.0.12",
         "@loopback/service-proxy": "^8.0.11",
-        "express": "^4.22.1",
+        "express": "^4.22.2",
         "tslib": "^2.8.1"
       },
       "devDependencies": {
@@ -780,7 +780,7 @@
         "compression": "^1.8.1",
         "cors": "^2.8.6",
         "debug": "^4.4.3",
-        "express": "^4.22.1",
+        "express": "^4.22.2",
         "helmet": "^4.6.0",
         "loopback": "^3.28.0",
         "loopback-boot": "^3.3.1",
@@ -975,7 +975,7 @@
         "body-parser": "^2.2.2",
         "client-sessions": "^0.8.0",
         "debug": "^4.4.3",
-        "express": "^4.22.1",
+        "express": "^4.22.2",
         "express-session": "^1.19.0",
         "lodash": "^4.18.1",
         "passport": "^0.7.0",
@@ -1122,7 +1122,7 @@
       "license": "MIT",
       "dependencies": {
         "@loopback/core": "^7.0.11",
-        "express": "^4.22.1",
+        "express": "^4.22.2",
         "tslib": "^2.8.1"
       },
       "devDependencies": {
@@ -1601,7 +1601,7 @@
         "@types/qs": "^6.15.1",
         "axios": "^1.16.0",
         "body-parser": "^2.2.2",
-        "express": "^4.22.1",
+        "express": "^4.22.2",
         "form-data": "^4.0.5",
         "jsonwebtoken": "^9.0.3",
         "lodash": "^4.18.1",
@@ -1729,7 +1729,7 @@
         "body-parser": "^2.2.2",
         "cors": "^2.8.6",
         "debug": "^4.4.3",
-        "express": "^4.22.1",
+        "express": "^4.22.2",
         "graphql": "^16.14.0",
         "graphql-ws": "^5.16.2",
         "type-graphql": "^2.0.0-rc.2",
@@ -1878,7 +1878,7 @@
         "@loopback/testlab": "^8.0.11",
         "@types/express": "^4.17.25",
         "@types/node": "^20.19.40",
-        "express": "^4.22.1"
+        "express": "^4.22.2"
       },
       "engines": {
         "node": "20 || 22 || 24"
@@ -2085,7 +2085,7 @@
         "@types/node": "^20.19.40",
         "axios": "^1.16.0",
         "body-parser": "^2.2.2",
-        "express": "^4.22.1",
+        "express": "^4.22.2",
         "form-data": "^4.0.5",
         "jsonwebtoken": "^9.0.3",
         "lodash": "^4.18.1",
@@ -16036,14 +16036,14 @@
       "integrity": "sha512-dX7e/LHVJ6W3DE1MHWi9S1EYzDESENfLrYohG2G++ovZrYOkm4Knwa0mc1cn84xJOR4KEU0WSchhLbd0UklbHw=="
     },
     "node_modules/express": {
-      "version": "4.22.1",
-      "resolved": "https://registry.npmjs.org/express/-/express-4.22.1.tgz",
-      "integrity": "sha512-F2X8g9P1X7uCPZMA3MVf9wcTqlyNp7IhH5qPCI0izhaOIYXaW9L535tGA3qmjRzpH+bZczqq7hVKxTR4NWnu+g==",
+      "version": "4.22.2",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.22.2.tgz",
+      "integrity": "sha512-IuL+Elrou2ZvCFHs18/CIzy2Nzvo25nZ1/D2eIZlz7c+QUayAcYoiM2BthCjs+EBHVpjYjcuLDAiCWgeIX3X1Q==",
       "license": "MIT",
       "dependencies": {
         "accepts": "~1.3.8",
         "array-flatten": "1.1.1",
-        "body-parser": "~1.20.3",
+        "body-parser": "~1.20.5",
         "content-disposition": "~0.5.4",
         "content-type": "~1.0.4",
         "cookie": "~0.7.1",
@@ -16062,7 +16062,7 @@
         "parseurl": "~1.3.3",
         "path-to-regexp": "~0.1.12",
         "proxy-addr": "~2.0.7",
-        "qs": "~6.14.0",
+        "qs": "~6.15.1",
         "range-parser": "~1.2.1",
         "safe-buffer": "5.2.1",
         "send": "~0.19.0",
@@ -16149,9 +16149,9 @@
       "license": "MIT"
     },
     "node_modules/express/node_modules/body-parser": {
-      "version": "1.20.4",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.4.tgz",
-      "integrity": "sha512-ZTgYYLMOXY9qKU/57FAo8F+HA2dGX7bqGc71txDRC1rS4frdFI5R7NhluHxH6M0YItAP0sHB4uqAOcYKxO6uGA==",
+      "version": "1.20.5",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz",
+      "integrity": "sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==",
       "license": "MIT",
       "dependencies": {
         "bytes": "~3.1.2",
@@ -16162,7 +16162,7 @@
         "http-errors": "~2.0.1",
         "iconv-lite": "~0.4.24",
         "on-finished": "~2.4.1",
-        "qs": "~6.14.0",
+        "qs": "~6.15.1",
         "raw-body": "~2.5.3",
         "type-is": "~1.6.18",
         "unpipe": "~1.0.0"
@@ -16197,26 +16197,11 @@
       "license": "MIT"
     },
     "node_modules/express/node_modules/path-to-regexp": {
-      "version": "0.1.12",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.12.tgz",
-      "integrity": "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==",
+      "version": "0.1.13",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.13.tgz",
+      "integrity": "sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==",
       "license": "MIT"
     },
-    "node_modules/express/node_modules/qs": {
-      "version": "6.14.2",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz",
-      "integrity": "sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==",
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "side-channel": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=0.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
     "node_modules/express/node_modules/raw-body": {
       "version": "2.5.3",
       "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.3.tgz",
@@ -40628,7 +40613,7 @@
         "@types/http-errors": "^2.0.5",
         "body-parser": "^2.2.2",
         "debug": "^4.4.3",
-        "express": "^4.22.1",
+        "express": "^4.22.2",
         "http-errors": "^2.0.1",
         "on-finished": "^2.4.1",
         "toposort": "^2.0.2",
@@ -41103,7 +41088,7 @@
         "body-parser": "^2.2.2",
         "cors": "^2.8.6",
         "debug": "^4.4.3",
-        "express": "^4.22.1",
+        "express": "^4.22.2",
         "http-errors": "^2.0.1",
         "js-yaml": "^4.1.1",
         "json-schema-compare": "^0.2.2",
@@ -41202,7 +41187,7 @@
         "@types/ejs": "^3.1.5",
         "@types/express": "^4.17.25",
         "@types/node": "^20.19.40",
-        "express": "^4.22.1"
+        "express": "^4.22.2"
       },
       "engines": {
         "node": "20 || 22 || 24"
@@ -41387,7 +41372,7 @@
         "@types/shot": "^4.0.5",
         "@types/sinon": "^21.0.1",
         "@types/supertest": "^2.0.16",
-        "express": "^4.22.1",
+        "express": "^4.22.2",
         "fs-extra": "^11.3.5",
         "oas-validator": "^5.0.8",
         "should": "^13.2.3",
diff --git a/packages/express/package.json b/packages/express/package.json
index 2ba5010f0153..07e0535f74cf 100644
--- a/packages/express/package.json
+++ b/packages/express/package.json
@@ -47,7 +47,7 @@
     "@types/http-errors": "^2.0.5",
     "body-parser": "^2.2.2",
     "debug": "^4.4.3",
-    "express": "^4.22.1",
+    "express": "^4.22.2",
     "http-errors": "^2.0.1",
     "on-finished": "^2.4.1",
     "toposort": "^2.0.2",
diff --git a/packages/rest-explorer/package.json b/packages/rest-explorer/package.json
index 103b3cb11e34..d7f0d08a2354 100644
--- a/packages/rest-explorer/package.json
+++ b/packages/rest-explorer/package.json
@@ -55,6 +55,6 @@
     "@types/ejs": "^3.1.5",
     "@types/express": "^4.17.25",
     "@types/node": "^20.19.40",
-    "express": "^4.22.1"
+    "express": "^4.22.2"
   }
 }
diff --git a/packages/rest/package.json b/packages/rest/package.json
index 96ddabb1ca6a..35da6cc6bd76 100644
--- a/packages/rest/package.json
+++ b/packages/rest/package.json
@@ -57,7 +57,7 @@
     "body-parser": "^2.2.2",
     "cors": "^2.8.6",
     "debug": "^4.4.3",
-    "express": "^4.22.1",
+    "express": "^4.22.2",
     "http-errors": "^2.0.1",
     "js-yaml": "^4.1.1",
     "json-schema-compare": "^0.2.2",
diff --git a/packages/testlab/package.json b/packages/testlab/package.json
index 6b3d477c880c..10f330b39586 100644
--- a/packages/testlab/package.json
+++ b/packages/testlab/package.json
@@ -40,7 +40,7 @@
     "@types/shot": "^4.0.5",
     "@types/sinon": "^21.0.1",
     "@types/supertest": "^2.0.16",
-    "express": "^4.22.1",
+    "express": "^4.22.2",
     "fs-extra": "^11.3.5",
     "oas-validator": "^5.0.8",
     "should": "^13.2.3",