diff --git a/package-lock.json b/package-lock.json
index e40fb533cf..30b45803c7 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -14227,18 +14227,19 @@
             "license": "Apache-2.0"
         },
         "node_modules/express": {
-            "version": "5.1.0",
-            "resolved": "https://registry.npmjs.org/express/-/express-5.1.0.tgz",
-            "integrity": "sha512-DT9ck5YIRU+8GYzzU5kT3eHGA5iL+1Zd0EutOmTE9Dtk+Tvuzd23VBU+ec7HPNSTxXYO55gPV/hq4pSBJDjFpA==",
+            "version": "5.2.0",
+            "resolved": "https://registry.npmjs.org/express/-/express-5.2.0.tgz",
+            "integrity": "sha512-XdpJDLxfztVY59X0zPI6sibRiGcxhTPXRD3IhJmjKf2jwMvkRGV1j7loB8U+heeamoU3XvihAaGRTR4aXXUN3A==",
             "license": "MIT",
             "dependencies": {
                 "accepts": "^2.0.0",
-                "body-parser": "^2.2.0",
+                "body-parser": "^2.2.1",
                 "content-disposition": "^1.0.0",
                 "content-type": "^1.0.5",
                 "cookie": "^0.7.1",
                 "cookie-signature": "^1.2.1",
                 "debug": "^4.4.0",
+                "depd": "^2.0.0",
                 "encodeurl": "^2.0.0",
                 "escape-html": "^1.0.3",
                 "etag": "^1.8.1",
@@ -28809,7 +28810,7 @@
                 "body-parser": "^2.2.1",
                 "dns2": "^2.1.0",
                 "dotenv": "^17.2.3",
-                "express": "^5.1.0",
+                "express": "^5.2.0",
                 "lodash": "^4.17.21",
                 "sqlite": "^5.1.1",
                 "sqlite3": "^5.1.7",
@@ -28956,7 +28957,7 @@
             "devDependencies": {
                 "@types/long-timeout": "^0.1.2",
                 "@types/tar": "^6.1.11",
-                "express": "^5.1.0"
+                "express": "^5.2.0"
             }
         },
         "packages/node": {
@@ -28979,7 +28980,7 @@
                 "cors": "^2.8.5",
                 "ethers": "^6.13.0",
                 "eventemitter3": "^5.0.0",
-                "express": "^5.1.0",
+                "express": "^5.2.0",
                 "heap": "^0.2.6",
                 "lodash": "^4.17.21",
                 "merge2": "^1.4.1",
@@ -29106,7 +29107,7 @@
                 "bytes": "^3.1.1",
                 "chromedriver": "^121.0.2",
                 "crypto-browserify": "^3.12.1",
-                "express": "^5.1.0",
+                "express": "^5.2.0",
                 "git-revision-webpack-plugin": "^5.0.0",
                 "jest-leak-detector": "^27.3.1",
                 "jest-matcher-utils": "^30.0.5",
@@ -29153,7 +29154,7 @@
                 "@streamr/utils": "103.2.0-rc.0",
                 "cors": "^2.8.5",
                 "ethers": "^6.13.0",
-                "express": "^5.1.0",
+                "express": "^5.2.0",
                 "jest": "^30.2.0",
                 "jest-matcher-utils": "^30.0.5",
                 "lodash": "^4.17.21"
diff --git a/packages/autocertifier-server/package.json b/packages/autocertifier-server/package.json
index 5669e31dad..081112d448 100644
--- a/packages/autocertifier-server/package.json
+++ b/packages/autocertifier-server/package.json
@@ -42,7 +42,7 @@
     "body-parser": "^2.2.1",
     "dns2": "^2.1.0",
     "dotenv": "^17.2.3",
-    "express": "^5.1.0",
+    "express": "^5.2.0",
     "lodash": "^4.17.21",
     "sqlite": "^5.1.1",
     "sqlite3": "^5.1.7",
diff --git a/packages/geoip-location/package.json b/packages/geoip-location/package.json
index 2e57d4f2b0..8fcca31d14 100644
--- a/packages/geoip-location/package.json
+++ b/packages/geoip-location/package.json
@@ -41,6 +41,6 @@
   "devDependencies": {
     "@types/long-timeout": "^0.1.2",
     "@types/tar": "^6.1.11",
-    "express": "^5.1.0"
+    "express": "^5.2.0"
   }
 }
diff --git a/packages/node/package.json b/packages/node/package.json
index 80b01ede7b..69b31ef70b 100644
--- a/packages/node/package.json
+++ b/packages/node/package.json
@@ -52,7 +52,7 @@
     "cors": "^2.8.5",
     "ethers": "^6.13.0",
     "eventemitter3": "^5.0.0",
-    "express": "^5.1.0",
+    "express": "^5.2.0",
     "heap": "^0.2.6",
     "lodash": "^4.17.21",
     "merge2": "^1.4.1",
diff --git a/packages/sdk/package.json b/packages/sdk/package.json
index 5b0a9c3d18..7a4e6750e7 100644
--- a/packages/sdk/package.json
+++ b/packages/sdk/package.json
@@ -73,7 +73,7 @@
     "bytes": "^3.1.1",
     "chromedriver": "^121.0.2",
     "crypto-browserify": "^3.12.1",
-    "express": "^5.1.0",
+    "express": "^5.2.0",
     "git-revision-webpack-plugin": "^5.0.0",
     "jest-leak-detector": "^27.3.1",
     "jest-matcher-utils": "^30.0.5",
diff --git a/packages/test-utils/package.json b/packages/test-utils/package.json
index 6d013868eb..d3920c434c 100644
--- a/packages/test-utils/package.json
+++ b/packages/test-utils/package.json
@@ -30,7 +30,7 @@
     "@streamr/utils": "103.2.0-rc.0",
     "cors": "^2.8.5",
     "ethers": "^6.13.0",
-    "express": "^5.1.0",
+    "express": "^5.2.0",
     "jest": "^30.2.0",
     "jest-matcher-utils": "^30.0.5",
     "lodash": "^4.17.21"