diff --git a/package-lock.json b/package-lock.json
index 51672dd9e36e..0f9611518630 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -195,7 +195,7 @@
         "benchmark": "^2.1.4",
         "byline": "^5.0.0",
         "debug": "^4.3.7",
-        "path-to-regexp": "^6.2.2",
+        "path-to-regexp": "^6.3.0",
         "tslib": "^2.6.3"
       },
       "devDependencies": {
@@ -380,7 +380,7 @@
         "@loopback/rest": "^14.0.6",
         "@loopback/rest-explorer": "^7.0.6",
         "@loopback/service-proxy": "^7.0.6",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "tslib": "^2.6.3"
       },
       "devDependencies": {
@@ -576,7 +576,7 @@
         "compression": "^1.7.4",
         "cors": "^2.8.5",
         "debug": "^4.3.7",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "helmet": "^4.6.0",
         "loopback": "^3.28.0",
         "loopback-boot": "^3.3.1",
@@ -731,7 +731,7 @@
         "body-parser": "^1.20.3",
         "client-sessions": "^0.8.0",
         "debug": "^4.3.7",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "express-session": "^1.18.0",
         "jade": "^1.11.0",
         "lodash": "^4.17.21",
@@ -848,7 +848,7 @@
       "license": "MIT",
       "dependencies": {
         "@loopback/core": "^6.1.3",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "tslib": "^2.6.3"
       },
       "devDependencies": {
@@ -1230,7 +1230,7 @@
         "@types/qs": "^6.9.15",
         "axios": "^1.7.2",
         "body-parser": "^1.20.3",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "form-data": "^4.0.0",
         "jsonwebtoken": "^9.0.2",
         "lodash": "^4.17.21",
@@ -1344,7 +1344,7 @@
         "@loopback/http-server": "^6.0.6",
         "apollo-server-express": "^3.12.1",
         "debug": "^4.3.7",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "graphql": "^15.9.0",
         "graphql-subscriptions": "^2.0.0",
         "type-graphql": "^1.1.1"
@@ -1458,7 +1458,7 @@
         "@loopback/testlab": "^7.0.6",
         "@types/express": "^4.17.21",
         "@types/node": "^16.18.101",
-        "express": "^4.20.0"
+        "express": "^4.19.2"
       },
       "engines": {
         "node": "18 || 20 || 22"
@@ -1625,7 +1625,7 @@
         "@types/node": "^16.18.101",
         "axios": "^1.7.2",
         "body-parser": "^1.20.3",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "form-data": "^4.0.0",
         "jsonwebtoken": "^9.0.2",
         "lodash": "^4.17.21",
@@ -27741,9 +27741,10 @@
       }
     },
     "node_modules/path-to-regexp": {
-      "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-6.2.2.tgz",
-      "integrity": "sha512-GQX3SSMokngb36+whdpRXE+3f9V8UzyAorlYvOGx87ufGHehNTn5lCxrKtLyZ4Yl/wEKnNnr98ZzOwwDZV5ogw=="
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-6.3.0.tgz",
+      "integrity": "sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==",
+      "license": "MIT"
     },
     "node_modules/path-type": {
       "version": "4.0.0",
@@ -37322,7 +37323,7 @@
         "@types/http-errors": "^2.0.4",
         "body-parser": "^1.20.3",
         "debug": "^4.3.7",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "http-errors": "^2.0.0",
         "on-finished": "^2.4.1",
         "toposort": "^2.0.2",
@@ -37688,13 +37689,13 @@
         "body-parser": "^1.20.3",
         "cors": "^2.8.5",
         "debug": "^4.3.7",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "http-errors": "^2.0.0",
         "js-yaml": "^4.1.0",
         "json-schema-compare": "^0.2.2",
         "lodash": "^4.17.21",
         "on-finished": "^2.4.1",
-        "path-to-regexp": "^6.2.2",
+        "path-to-regexp": "^6.3.0",
         "qs": "^6.12.3",
         "strong-error-handler": "^5.0.10",
         "tslib": "^2.6.3",
@@ -37777,7 +37778,7 @@
         "@types/ejs": "^3.1.5",
         "@types/express": "^4.17.21",
         "@types/node": "^16.18.101",
-        "express": "^4.20.0"
+        "express": "^4.19.2"
       },
       "engines": {
         "node": "18 || 20 || 22"
@@ -37870,7 +37871,7 @@
         "@types/shot": "^4.0.5",
         "@types/sinon": "^17.0.3",
         "@types/supertest": "^2.0.16",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "fs-extra": "^11.2.0",
         "oas-validator": "^5.0.8",
         "should": "^13.2.3",