diff --git a/package-lock.json b/package-lock.json
index 45c0ad2a529a8..18afc8478f007 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -13933,9 +13933,9 @@
       "license": "Apache-2.0"
     },
     "node_modules/express": {
-      "version": "4.21.1",
-      "resolved": "https://registry.npmjs.org/express/-/express-4.21.1.tgz",
-      "integrity": "sha512-YSFlK1Ee0/GC8QaO91tHcDxJiE/X4FbpAyQWkxAvG6AXCuR65YzK8ua6D9hvi/TzUfZMpc+BwuM1IPw8fmQBiQ==",
+      "version": "4.21.2",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.21.2.tgz",
+      "integrity": "sha512-28HqgMZAmih1Czt9ny7qr6ek2qddF4FclbMzwhCREB6OFfH+rXAnuNCwo1/wFvrtbgsQDb4kSbX9de9lFbrXnA==",
       "license": "MIT",
       "dependencies": {
         "accepts": "~1.3.8",
@@ -13957,7 +13957,7 @@
         "methods": "~1.1.2",
         "on-finished": "2.4.1",
         "parseurl": "~1.3.3",
-        "path-to-regexp": "0.1.10",
+        "path-to-regexp": "0.1.12",
         "proxy-addr": "~2.0.7",
         "qs": "6.13.0",
         "range-parser": "~1.2.1",
@@ -22517,9 +22517,9 @@
       }
     },
     "node_modules/path-to-regexp": {
-      "version": "0.1.10",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.10.tgz",
-      "integrity": "sha512-7lf7qcQidTku0Gu3YDPc8DJ1q7OOucfa/BSsIwjuh56VU7katFvuM8hULfkwB3Fns/rsVF7PwPKVw1sl5KQS9w==",
+      "version": "0.1.12",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.12.tgz",
+      "integrity": "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==",
       "license": "MIT"
     },
     "node_modules/path-type": {
@@ -30177,7 +30177,7 @@
         "dompurify": "^2.2.9",
         "drivelist": "^12.0.2",
         "es6-promise": "^4.2.4",
-        "express": "^4.21.0",
+        "express": "^4.21.2",
         "fast-json-stable-stringify": "^2.1.0",
         "file-icons-js": "~1.0.3",
         "font-awesome": "^4.7.0",
diff --git a/packages/core/README.md b/packages/core/README.md
index c1f4280c5e2c0..af0a4f3f7c3be 100644
--- a/packages/core/README.md
+++ b/packages/core/README.md
@@ -102,7 +102,7 @@ export class SomeClass {
   - `vscode-uri` (from [`vscode-uri@^2.1.1`](https://www.npmjs.com/package/vscode-uri))
   - `@parcel/watcher` (from [`@parcel/watcher@^2.5.0`](https://www.npmjs.com/package/@parcel/watcher))
   - `dompurify` (from [`dompurify@^2.2.9`](https://www.npmjs.com/package/dompurify))
-  - `express` (from [`express@^4.21.0`](https://www.npmjs.com/package/express))
+  - `express` (from [`express@^4.21.2`](https://www.npmjs.com/package/express))
   - `lodash.debounce` (from [`lodash.debounce@^4.0.8`](https://www.npmjs.com/package/lodash.debounce))
   - `lodash.throttle` (from [`lodash.throttle@^4.1.1`](https://www.npmjs.com/package/lodash.throttle))
   - `markdown-it` (from [`markdown-it@^12.3.2`](https://www.npmjs.com/package/markdown-it))
diff --git a/packages/core/package.json b/packages/core/package.json
index c235039fe0572..69b96c2bfaba3 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -42,7 +42,7 @@
     "dompurify": "^2.2.9",
     "drivelist": "^12.0.2",
     "es6-promise": "^4.2.4",
-    "express": "^4.21.0",
+    "express": "^4.21.2",
     "fast-json-stable-stringify": "^2.1.0",
     "file-icons-js": "~1.0.3",
     "font-awesome": "^4.7.0",