diff --git a/examples/aws-companion/package.json b/examples/aws-companion/package.json
index 49f1819c94..f52463b723 100644
--- a/examples/aws-companion/package.json
+++ b/examples/aws-companion/package.json
@@ -15,7 +15,7 @@
     "cookie-parser": "^1.4.6",
     "cors": "^2.8.5",
     "dotenv": "^16.0.1",
-    "express": "^4.19.2",
+    "express": "^4.20.0",
     "express-session": "^1.17.3",
     "npm-run-all": "^4.1.5",
     "vite": "^5.0.0"
diff --git a/examples/aws-nodejs/package.json b/examples/aws-nodejs/package.json
index ed07df7f8c..8d02997af2 100644
--- a/examples/aws-nodejs/package.json
+++ b/examples/aws-nodejs/package.json
@@ -15,6 +15,6 @@
     "@aws-sdk/s3-request-presigner": "^3.338.0",
     "body-parser": "^1.20.0",
     "dotenv": "^16.0.0",
-    "express": "^4.19.2"
+    "express": "^4.20.0"
   }
 }
diff --git a/examples/custom-provider/package.json b/examples/custom-provider/package.json
index afcf1b175e..e7245c308d 100644
--- a/examples/custom-provider/package.json
+++ b/examples/custom-provider/package.json
@@ -18,7 +18,7 @@
     "@uppy/companion": "workspace:*",
     "body-parser": "^1.18.2",
     "dotenv": "^16.0.1",
-    "express": "^4.19.2",
+    "express": "^4.20.0",
     "express-session": "^1.15.6",
     "npm-run-all": "^4.1.2",
     "vite": "^5.0.0"
diff --git a/examples/digitalocean-spaces/package.json b/examples/digitalocean-spaces/package.json
index 2339161ec7..e57c0847b0 100644
--- a/examples/digitalocean-spaces/package.json
+++ b/examples/digitalocean-spaces/package.json
@@ -11,7 +11,7 @@
   },
   "devDependencies": {
     "dotenv": "^16.0.1",
-    "express": "^4.19.2",
+    "express": "^4.20.0",
     "vite": "^5.0.0"
   },
   "private": true,
diff --git a/examples/transloadit/package.json b/examples/transloadit/package.json
index 205b2f3734..f2742944ab 100644
--- a/examples/transloadit/package.json
+++ b/examples/transloadit/package.json
@@ -16,7 +16,7 @@
     "@uppy/remote-sources": "workspace:*",
     "@uppy/transloadit": "workspace:*",
     "@uppy/webcam": "workspace:*",
-    "express": "^4.19.2",
+    "express": "^4.20.0",
     "he": "^1.2.0"
   },
   "private": true,
diff --git a/examples/uppy-with-companion/package.json b/examples/uppy-with-companion/package.json
index 310e183cb1..054c416d19 100644
--- a/examples/uppy-with-companion/package.json
+++ b/examples/uppy-with-companion/package.json
@@ -4,7 +4,7 @@
   "dependencies": {
     "@uppy/companion": "workspace:*",
     "body-parser": "^1.18.2",
-    "express": "^4.19.2",
+    "express": "^4.20.0",
     "express-session": "^1.15.6",
     "light-server": "^2.4.0",
     "upload-server": "^1.1.6"
diff --git a/examples/xhr-bundle/package.json b/examples/xhr-bundle/package.json
index 2899a4f4d1..78273d28af 100644
--- a/examples/xhr-bundle/package.json
+++ b/examples/xhr-bundle/package.json
@@ -6,7 +6,7 @@
     "@uppy/dashboard": "workspace:*",
     "@uppy/xhr-upload": "workspace:*",
     "cors": "^2.8.5",
-    "express": "^4.19.2",
+    "express": "^4.20.0",
     "multer": "^1.4.1"
   },
   "devDependencies": {
diff --git a/packages/@uppy/companion/package.json b/packages/@uppy/companion/package.json
index cf4e68c516..9a284010c2 100644
--- a/packages/@uppy/companion/package.json
+++ b/packages/@uppy/companion/package.json
@@ -41,7 +41,7 @@
     "cors": "^2.8.5",
     "escape-goat": "3.0.0",
     "escape-string-regexp": "4.0.0",
-    "express": "4.19.2",
+    "express": "4.20.0",
     "express-interceptor": "1.2.0",
     "express-prom-bundle": "7.0.0",
     "express-session": "1.18.0",
diff --git a/yarn.lock b/yarn.lock
index d0a355f32e..eddc69cc6b 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -8210,7 +8210,7 @@ __metadata:
     cookie-parser: "npm:^1.4.6"
     cors: "npm:^2.8.5"
     dotenv: "npm:^16.0.1"
-    express: "npm:^4.19.2"
+    express: "npm:^4.20.0"
     express-session: "npm:^1.17.3"
     npm-run-all: "npm:^4.1.5"
     vite: "npm:^5.0.0"
@@ -8226,7 +8226,7 @@ __metadata:
     "@aws-sdk/s3-request-presigner": "npm:^3.338.0"
     body-parser: "npm:^1.20.0"
     dotenv: "npm:^16.0.0"
-    express: "npm:^4.19.2"
+    express: "npm:^4.20.0"
   languageName: unknown
   linkType: soft
 
@@ -8276,7 +8276,7 @@ __metadata:
     "@uppy/tus": "workspace:*"
     body-parser: "npm:^1.18.2"
     dotenv: "npm:^16.0.1"
-    express: "npm:^4.19.2"
+    express: "npm:^4.20.0"
     express-session: "npm:^1.15.6"
     npm-run-all: "npm:^4.1.2"
     preact: "npm:^10.5.13"
@@ -8294,7 +8294,7 @@ __metadata:
     body-parser: "npm:^1.18.3"
     cors: "npm:^2.8.5"
     dotenv: "npm:^16.0.1"
-    express: "npm:^4.19.2"
+    express: "npm:^4.20.0"
     vite: "npm:^5.0.0"
   languageName: unknown
   linkType: soft
@@ -8461,7 +8461,7 @@ __metadata:
     "@uppy/remote-sources": "workspace:*"
     "@uppy/transloadit": "workspace:*"
     "@uppy/webcam": "workspace:*"
-    express: "npm:^4.19.2"
+    express: "npm:^4.20.0"
     he: "npm:^1.2.0"
     npm-run-all: "npm:^4.1.5"
     vite: "npm:^5.0.0"
@@ -8474,7 +8474,7 @@ __metadata:
   dependencies:
     "@uppy/companion": "workspace:*"
     body-parser: "npm:^1.18.2"
-    express: "npm:^4.19.2"
+    express: "npm:^4.20.0"
     express-session: "npm:^1.15.6"
     light-server: "npm:^2.4.0"
     upload-server: "npm:^1.1.6"
@@ -8506,7 +8506,7 @@ __metadata:
     "@uppy/dashboard": "workspace:*"
     "@uppy/xhr-upload": "workspace:*"
     cors: "npm:^2.8.5"
-    express: "npm:^4.19.2"
+    express: "npm:^4.20.0"
     multer: "npm:^1.4.1"
     npm-run-all: "npm:^4.1.5"
     vite: "npm:^5.0.0"
@@ -8623,7 +8623,7 @@ __metadata:
     cors: "npm:^2.8.5"
     escape-goat: "npm:3.0.0"
     escape-string-regexp: "npm:4.0.0"
-    express: "npm:4.19.2"
+    express: "npm:4.20.0"
     express-interceptor: "npm:1.2.0"
     express-prom-bundle: "npm:7.0.0"
     express-session: "npm:1.18.0"
@@ -10868,6 +10868,26 @@ __metadata:
   languageName: node
   linkType: hard
 
+"body-parser@npm:1.20.3":
+  version: 1.20.3
+  resolution: "body-parser@npm:1.20.3"
+  dependencies:
+    bytes: "npm:3.1.2"
+    content-type: "npm:~1.0.5"
+    debug: "npm:2.6.9"
+    depd: "npm:2.0.0"
+    destroy: "npm:1.2.0"
+    http-errors: "npm:2.0.0"
+    iconv-lite: "npm:0.4.24"
+    on-finished: "npm:2.4.1"
+    qs: "npm:6.13.0"
+    raw-body: "npm:2.5.2"
+    type-is: "npm:~1.6.18"
+    unpipe: "npm:1.0.0"
+  checksum: 10/8723e3d7a672eb50854327453bed85ac48d045f4958e81e7d470c56bf111f835b97e5b73ae9f6393d0011cc9e252771f46fd281bbabc57d33d3986edf1e6aeca
+  languageName: node
+  linkType: hard
+
 "bonjour-service@npm:^1.2.1":
   version: 1.2.1
   resolution: "bonjour-service@npm:1.2.1"
@@ -13539,6 +13559,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"encodeurl@npm:~2.0.0":
+  version: 2.0.0
+  resolution: "encodeurl@npm:2.0.0"
+  checksum: 10/abf5cd51b78082cf8af7be6785813c33b6df2068ce5191a40ca8b1afe6a86f9230af9a9ce694a5ce4665955e5c1120871826df9c128a642e09c58d592e2807fe
+  languageName: node
+  linkType: hard
+
 "encoding@npm:^0.1.11, encoding@npm:^0.1.13":
   version: 0.1.13
   resolution: "encoding@npm:0.1.13"
@@ -15152,7 +15179,46 @@ __metadata:
   languageName: node
   linkType: hard
 
-"express@npm:4.19.2, express@npm:^4.14.0, express@npm:^4.17.3, express@npm:^4.18.2, express@npm:^4.19.2":
+"express@npm:4.20.0":
+  version: 4.20.0
+  resolution: "express@npm:4.20.0"
+  dependencies:
+    accepts: "npm:~1.3.8"
+    array-flatten: "npm:1.1.1"
+    body-parser: "npm:1.20.3"
+    content-disposition: "npm:0.5.4"
+    content-type: "npm:~1.0.4"
+    cookie: "npm:0.6.0"
+    cookie-signature: "npm:1.0.6"
+    debug: "npm:2.6.9"
+    depd: "npm:2.0.0"
+    encodeurl: "npm:~2.0.0"
+    escape-html: "npm:~1.0.3"
+    etag: "npm:~1.8.1"
+    finalhandler: "npm:1.2.0"
+    fresh: "npm:0.5.2"
+    http-errors: "npm:2.0.0"
+    merge-descriptors: "npm:1.0.3"
+    methods: "npm:~1.1.2"
+    on-finished: "npm:2.4.1"
+    parseurl: "npm:~1.3.3"
+    path-to-regexp: "npm:0.1.10"
+    proxy-addr: "npm:~2.0.7"
+    qs: "npm:6.11.0"
+    range-parser: "npm:~1.2.1"
+    safe-buffer: "npm:5.2.1"
+    send: "npm:0.19.0"
+    serve-static: "npm:1.16.0"
+    setprototypeof: "npm:1.2.0"
+    statuses: "npm:2.0.1"
+    type-is: "npm:~1.6.18"
+    utils-merge: "npm:1.0.1"
+    vary: "npm:~1.1.2"
+  checksum: 10/4131f566cf8f6d1611475d5ff5d0dbc5c628ad8b525aa2aa2b3da9a23a041efcce09ede10b8a31315b0258ac4e53208a009fd7669ee1eb385936a0d54adb3cde
+  languageName: node
+  linkType: hard
+
+"express@npm:^4.14.0, express@npm:^4.17.3, express@npm:^4.18.2":
   version: 4.19.2
   resolution: "express@npm:4.19.2"
   dependencies:
@@ -15191,6 +15257,45 @@ __metadata:
   languageName: node
   linkType: hard
 
+"express@npm:^4.20.0":
+  version: 4.21.0
+  resolution: "express@npm:4.21.0"
+  dependencies:
+    accepts: "npm:~1.3.8"
+    array-flatten: "npm:1.1.1"
+    body-parser: "npm:1.20.3"
+    content-disposition: "npm:0.5.4"
+    content-type: "npm:~1.0.4"
+    cookie: "npm:0.6.0"
+    cookie-signature: "npm:1.0.6"
+    debug: "npm:2.6.9"
+    depd: "npm:2.0.0"
+    encodeurl: "npm:~2.0.0"
+    escape-html: "npm:~1.0.3"
+    etag: "npm:~1.8.1"
+    finalhandler: "npm:1.3.1"
+    fresh: "npm:0.5.2"
+    http-errors: "npm:2.0.0"
+    merge-descriptors: "npm:1.0.3"
+    methods: "npm:~1.1.2"
+    on-finished: "npm:2.4.1"
+    parseurl: "npm:~1.3.3"
+    path-to-regexp: "npm:0.1.10"
+    proxy-addr: "npm:~2.0.7"
+    qs: "npm:6.13.0"
+    range-parser: "npm:~1.2.1"
+    safe-buffer: "npm:5.2.1"
+    send: "npm:0.19.0"
+    serve-static: "npm:1.16.2"
+    setprototypeof: "npm:1.2.0"
+    statuses: "npm:2.0.1"
+    type-is: "npm:~1.6.18"
+    utils-merge: "npm:1.0.1"
+    vary: "npm:~1.1.2"
+  checksum: 10/3b1ee5bc5b1bd996f688702519cebc9b63a24e506965f6e1773268238cfa2c24ffdb38cc3fcb4fde66f77de1c0bebd9ee058dad06bb9c6f084b525f3c09164d3
+  languageName: node
+  linkType: hard
+
 "extend-shallow@npm:^2.0.1":
   version: 2.0.1
   resolution: "extend-shallow@npm:2.0.1"
@@ -15519,6 +15624,21 @@ __metadata:
   languageName: node
   linkType: hard
 
+"finalhandler@npm:1.3.1":
+  version: 1.3.1
+  resolution: "finalhandler@npm:1.3.1"
+  dependencies:
+    debug: "npm:2.6.9"
+    encodeurl: "npm:~2.0.0"
+    escape-html: "npm:~1.0.3"
+    on-finished: "npm:2.4.1"
+    parseurl: "npm:~1.3.3"
+    statuses: "npm:2.0.1"
+    unpipe: "npm:~1.0.0"
+  checksum: 10/4babe72969b7373b5842bc9f75c3a641a4d0f8eb53af6b89fa714d4460ce03fb92b28de751d12ba415e96e7e02870c436d67412120555e2b382640535697305b
+  languageName: node
+  linkType: hard
+
 "finalhandler@npm:^0.3.0":
   version: 0.3.6
   resolution: "finalhandler@npm:0.3.6"
@@ -20647,6 +20767,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"merge-descriptors@npm:1.0.3":
+  version: 1.0.3
+  resolution: "merge-descriptors@npm:1.0.3"
+  checksum: 10/52117adbe0313d5defa771c9993fe081e2d2df9b840597e966aadafde04ae8d0e3da46bac7ca4efc37d4d2b839436582659cd49c6a43eacb3fe3050896a105d1
+  languageName: node
+  linkType: hard
+
 "merge-options@npm:^3.0.4":
   version: 3.0.4
   resolution: "merge-options@npm:3.0.4"
@@ -23676,6 +23803,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"path-to-regexp@npm:0.1.10":
+  version: 0.1.10
+  resolution: "path-to-regexp@npm:0.1.10"
+  checksum: 10/894e31f1b20e592732a87db61fff5b95c892a3fe430f9ab18455ebe69ee88ef86f8eb49912e261f9926fc53da9f93b46521523e33aefd9cb0a7b0d85d7096006
+  languageName: node
+  linkType: hard
+
 "path-to-regexp@npm:0.1.7":
   version: 0.1.7
   resolution: "path-to-regexp@npm:0.1.7"
@@ -24772,6 +24906,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"qs@npm:6.13.0":
+  version: 6.13.0
+  resolution: "qs@npm:6.13.0"
+  dependencies:
+    side-channel: "npm:^1.0.6"
+  checksum: 10/f548b376e685553d12e461409f0d6e5c59ec7c7d76f308e2a888fd9db3e0c5e89902bedd0754db3a9038eda5f27da2331a6f019c8517dc5e0a16b3c9a6e9cef8
+  languageName: node
+  linkType: hard
+
 "qs@npm:^6.11.0, qs@npm:^6.11.2, qs@npm:^6.9.6":
   version: 6.12.1
   resolution: "qs@npm:6.12.1"
@@ -26546,6 +26689,27 @@ __metadata:
   languageName: node
   linkType: hard
 
+"send@npm:0.19.0":
+  version: 0.19.0
+  resolution: "send@npm:0.19.0"
+  dependencies:
+    debug: "npm:2.6.9"
+    depd: "npm:2.0.0"
+    destroy: "npm:1.2.0"
+    encodeurl: "npm:~1.0.2"
+    escape-html: "npm:~1.0.3"
+    etag: "npm:~1.8.1"
+    fresh: "npm:0.5.2"
+    http-errors: "npm:2.0.0"
+    mime: "npm:1.6.0"
+    ms: "npm:2.1.3"
+    on-finished: "npm:2.4.1"
+    range-parser: "npm:~1.2.1"
+    statuses: "npm:2.0.1"
+  checksum: 10/1f6064dea0ae4cbe4878437aedc9270c33f2a6650a77b56a16b62d057527f2766d96ee282997dd53ec0339082f2aad935bc7d989b46b48c82fc610800dc3a1d0
+  languageName: node
+  linkType: hard
+
 "serialize-error@npm:^11.0.0":
   version: 11.0.3
   resolution: "serialize-error@npm:11.0.3"
@@ -26598,6 +26762,30 @@ __metadata:
   languageName: node
   linkType: hard
 
+"serve-static@npm:1.16.0":
+  version: 1.16.0
+  resolution: "serve-static@npm:1.16.0"
+  dependencies:
+    encodeurl: "npm:~1.0.2"
+    escape-html: "npm:~1.0.3"
+    parseurl: "npm:~1.3.3"
+    send: "npm:0.18.0"
+  checksum: 10/29a01f67e8c64a359d49dd0c46bc95bb4aa99781f97845dccbf0c8cd0284c5fd79ad7fb9433a36fac4b6c58b577d3eab314a379142412413b8b5cd73be3cd551
+  languageName: node
+  linkType: hard
+
+"serve-static@npm:1.16.2":
+  version: 1.16.2
+  resolution: "serve-static@npm:1.16.2"
+  dependencies:
+    encodeurl: "npm:~2.0.0"
+    escape-html: "npm:~1.0.3"
+    parseurl: "npm:~1.3.3"
+    send: "npm:0.19.0"
+  checksum: 10/7fa9d9c68090f6289976b34fc13c50ac8cd7f16ae6bce08d16459300f7fc61fbc2d7ebfa02884c073ec9d6ab9e7e704c89561882bbe338e99fcacb2912fde737
+  languageName: node
+  linkType: hard
+
 "serve-static@npm:~1.14.1":
   version: 1.14.2
   resolution: "serve-static@npm:1.14.2"