Will the fix for the CVE https://github.com/advisories/GHSA-wqch-xfxh-vrr4 be ported back to V1 for Express 4 support?