diff --git a/.changeset/dry-bikes-try.md b/.changeset/dry-bikes-try.md
new file mode 100644
index 000000000..17a91dc99
--- /dev/null
+++ b/.changeset/dry-bikes-try.md
@@ -0,0 +1,6 @@
+---
+'@web/storybook-builder': patch
+'@web/dev-server-core': patch
+---
+
+Bump express to 4.21.2 to include path-to-regexp fix
diff --git a/package-lock.json b/package-lock.json
index 137398f24..fbd88fe64 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -18645,9 +18645,9 @@
       }
     },
     "node_modules/express": {
-      "version": "4.21.1",
-      "resolved": "https://registry.npmjs.org/express/-/express-4.21.1.tgz",
-      "integrity": "sha512-YSFlK1Ee0/GC8QaO91tHcDxJiE/X4FbpAyQWkxAvG6AXCuR65YzK8ua6D9hvi/TzUfZMpc+BwuM1IPw8fmQBiQ==",
+      "version": "4.21.2",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.21.2.tgz",
+      "integrity": "sha512-28HqgMZAmih1Czt9ny7qr6ek2qddF4FclbMzwhCREB6OFfH+rXAnuNCwo1/wFvrtbgsQDb4kSbX9de9lFbrXnA==",
       "dependencies": {
         "accepts": "~1.3.8",
         "array-flatten": "1.1.1",
@@ -18668,7 +18668,7 @@
         "methods": "~1.1.2",
         "on-finished": "2.4.1",
         "parseurl": "~1.3.3",
-        "path-to-regexp": "0.1.10",
+        "path-to-regexp": "0.1.12",
         "proxy-addr": "~2.0.7",
         "qs": "6.13.0",
         "range-parser": "~1.2.1",
@@ -18683,6 +18683,10 @@
       },
       "engines": {
         "node": ">= 0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/express/node_modules/cookie": {
@@ -28584,9 +28588,9 @@
       }
     },
     "node_modules/path-to-regexp": {
-      "version": "0.1.10",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.10.tgz",
-      "integrity": "sha512-7lf7qcQidTku0Gu3YDPc8DJ1q7OOucfa/BSsIwjuh56VU7katFvuM8hULfkwB3Fns/rsVF7PwPKVw1sl5KQS9w=="
+      "version": "0.1.12",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.12.tgz",
+      "integrity": "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ=="
     },
     "node_modules/path-type": {
       "version": "4.0.0",
@@ -39832,7 +39836,7 @@
         "@types/koa-static": "^4.0.1",
         "@types/parse5": "^6.0.1",
         "abort-controller": "^3.0.0",
-        "express": "^4.21.1",
+        "express": "^4.21.2",
         "nanoid": "^3.1.25",
         "portfinder": "^1.0.32"
       },
@@ -41597,7 +41601,7 @@
         "cjs-module-lexer": "^1.2.3",
         "es-module-lexer": "^1.2.1",
         "esbuild": "^0.24.0",
-        "express": "^4.21.1",
+        "express": "^4.21.2",
         "fs-extra": "^11.1.1",
         "glob-promise": "^6.0.3",
         "lodash-es": "^4.17.21",
diff --git a/packages/dev-server-core/package.json b/packages/dev-server-core/package.json
index b1b645f2f..4f1a7b2da 100644
--- a/packages/dev-server-core/package.json
+++ b/packages/dev-server-core/package.json
@@ -83,7 +83,7 @@
     "@types/koa-static": "^4.0.1",
     "@types/parse5": "^6.0.1",
     "abort-controller": "^3.0.0",
-    "express": "^4.21.1",
+    "express": "^4.21.2",
     "nanoid": "^3.1.25",
     "portfinder": "^1.0.32"
   }
diff --git a/packages/storybook-builder/package.json b/packages/storybook-builder/package.json
index 86426e2ab..4ee256ed6 100644
--- a/packages/storybook-builder/package.json
+++ b/packages/storybook-builder/package.json
@@ -61,7 +61,7 @@
     "cjs-module-lexer": "^1.2.3",
     "es-module-lexer": "^1.2.1",
     "esbuild": "^0.24.0",
-    "express": "^4.21.1",
+    "express": "^4.21.2",
     "fs-extra": "^11.1.1",
     "glob-promise": "^6.0.3",
     "lodash-es": "^4.17.21",