diff --git a/.changeset/poor-insects-arrive.md b/.changeset/poor-insects-arrive.md
new file mode 100644
index 000000000..90481cce2
--- /dev/null
+++ b/.changeset/poor-insects-arrive.md
@@ -0,0 +1,6 @@
+---
+'@web/storybook-builder': patch
+'@web/dev-server-core': patch
+---
+
+bump "express" from 4.18.2 to 4.21.1 to use updated "cookie" with vulnerability fixes