Express 4.22.2 has qs vulnerable dependency

## Environment information

**Version**: 4.22.2

**Platform**: x86, x64

**Node.js version**: "node": ">= 0.10.0"

**Any other relevant information**:

## What steps will reproduce the bug?

express 4.22.2 uses qs 6.15.2 version as dependency, where qs 6.15.2 is reported as vulnerability as
CVE-2026-82417, CVE-2026-82562
https://security.snyk.io/package/npm/qs

Start with the root package.json and inspect the dependency declarations for Express and qs, then verify the resolved qs version against the reported CVEs. Check the repository's existing dependency or test workflow if available; done means Express no longer resolves to the reported vulnerable qs version and the existing checks still pass.

Written by the indexing model from the issue text.