diff --git a/ghost/core/package.json b/ghost/core/package.json
index d2ec54b588..f956ef50d8 100644
--- a/ghost/core/package.json
+++ b/ghost/core/package.json
@@ -181,7 +181,7 @@
     "cors": "2.8.5",
     "dompurify": "3.2.3",
     "downsize": "0.0.8",
-    "express": "4.21.1",
+    "express": "4.21.2",
     "express-brute": "1.0.1",
     "express-hbs": "2.5.0",
     "express-jwt": "8.5.1",
diff --git a/ghost/ghost/package.json b/ghost/ghost/package.json
index ef1d076c9a..c32597d326 100644
--- a/ghost/ghost/package.json
+++ b/ghost/ghost/package.json
@@ -38,7 +38,7 @@
     "@nestjs/platform-express": "10.4.4",
     "@tryghost/errors": "1.3.5",
     "bson-objectid": "2.0.4",
-    "express": "4.21.1",
+    "express": "4.21.2",
     "reflect-metadata": "0.1.14",
     "rxjs": "7.8.1"
   }
diff --git a/ghost/members-api/package.json b/ghost/members-api/package.json
index 7f0e954bf0..d9a1479425 100644
--- a/ghost/members-api/package.json
+++ b/ghost/members-api/package.json
@@ -42,7 +42,7 @@
     "@types/jsonwebtoken": "9.0.6",
     "body-parser": "1.20.3",
     "bson-objectid": "2.0.4",
-    "express": "4.21.1",
+    "express": "4.21.2",
     "got": "11.8.6",
     "jsonwebtoken": "8.5.1",
     "lodash": "4.17.21",
diff --git a/ghost/mw-session-from-token/package.json b/ghost/mw-session-from-token/package.json
index 53f3afc8ba..5217c16122 100644
--- a/ghost/mw-session-from-token/package.json
+++ b/ghost/mw-session-from-token/package.json
@@ -19,7 +19,7 @@
   ],
   "devDependencies": {
     "c8": "8.0.1",
-    "express": "4.21.1",
+    "express": "4.21.2",
     "mocha": "10.2.0",
     "should": "13.2.3",
     "sinon": "15.2.0"
diff --git a/ghost/prometheus-metrics/package.json b/ghost/prometheus-metrics/package.json
index 46dae48d3d..8207998e79 100644
--- a/ghost/prometheus-metrics/package.json
+++ b/ghost/prometheus-metrics/package.json
@@ -35,7 +35,7 @@
   },
   "dependencies": {
     "@tryghost/logging": "2.4.19",
-    "express": "4.21.1",
+    "express": "4.21.2",
     "prom-client": "15.1.3",
     "stoppable": "1.1.0"
   }
diff --git a/ghost/session-service/package.json b/ghost/session-service/package.json
index 87eb7023e5..425cb300dd 100644
--- a/ghost/session-service/package.json
+++ b/ghost/session-service/package.json
@@ -19,7 +19,7 @@
   ],
   "devDependencies": {
     "c8": "8.0.1",
-    "express": "4.21.1",
+    "express": "4.21.2",
     "mocha": "10.2.0",
     "should": "13.2.3",
     "sinon": "15.2.0"
diff --git a/yarn.lock b/yarn.lock
index 0903c4d16e..cc53f9095c 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -17263,10 +17263,10 @@ express@4.21.0:
     utils-merge "1.0.1"
     vary "~1.1.2"
 
-express@4.21.1, express@^4.10.7, express@^4.17.1, express@^4.17.2, express@^4.17.3, express@^4.18.2:
-  version "4.21.1"
-  resolved "https://registry.yarnpkg.com/express/-/express-4.21.1.tgz#9dae5dda832f16b4eec941a4e44aa89ec481b281"
-  integrity sha512-YSFlK1Ee0/GC8QaO91tHcDxJiE/X4FbpAyQWkxAvG6AXCuR65YzK8ua6D9hvi/TzUfZMpc+BwuM1IPw8fmQBiQ==
+express@4.21.2, express@^4.10.7, express@^4.17.1, express@^4.17.2, express@^4.17.3, express@^4.18.2:
+  version "4.21.2"
+  resolved "https://registry.yarnpkg.com/express/-/express-4.21.2.tgz#cf250e48362174ead6cea4a566abef0162c1ec32"
+  integrity sha512-28HqgMZAmih1Czt9ny7qr6ek2qddF4FclbMzwhCREB6OFfH+rXAnuNCwo1/wFvrtbgsQDb4kSbX9de9lFbrXnA==
   dependencies:
     accepts "~1.3.8"
     array-flatten "1.1.1"
@@ -17287,7 +17287,7 @@ express@4.21.1, express@^4.10.7, express@^4.17.1, express@^4.17.2, express@^4.17
     methods "~1.1.2"
     on-finished "2.4.1"
     parseurl "~1.3.3"
-    path-to-regexp "0.1.10"
+    path-to-regexp "0.1.12"
     proxy-addr "~2.0.7"
     qs "6.13.0"
     range-parser "~1.2.1"
@@ -25144,6 +25144,11 @@ path-to-regexp@0.1.10:
   resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-0.1.10.tgz#67e9108c5c0551b9e5326064387de4763c4d5f8b"
   integrity sha512-7lf7qcQidTku0Gu3YDPc8DJ1q7OOucfa/BSsIwjuh56VU7katFvuM8hULfkwB3Fns/rsVF7PwPKVw1sl5KQS9w==
 
+path-to-regexp@0.1.12:
+  version "0.1.12"
+  resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-0.1.12.tgz#d5e1a12e478a976d432ef3c58d534b9923164bb7"
+  integrity sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==
+
 path-to-regexp@3.3.0:
   version "3.3.0"
   resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-3.3.0.tgz#f7f31d32e8518c2660862b644414b6d5c63a611b"