diff --git a/NEWS.md b/NEWS.md
index c20ae985..a5d3e7d3 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -3,6 +3,7 @@
 ## 3.13.0
 Released 2017-mm-dd
  - Upgrades camshaft, cartodb-query-tables, and turbo-carto: better support for query variables.
+ - Upgrades express, debug, request and body-parser for sequrity reasons
 
 Bugfixes:
  - Bounding box parameter ignored in static named maps #735.
diff --git a/package.json b/package.json
index 4370b036..39aedfa6 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,7 @@
     "cartodb-redis": "0.14.0",
     "debug": "^3.1.0",
     "dot": "~1.0.2",
-    "express": "^4.15.5",
+    "express": "~4.16.0",
     "fastly-purge": "~1.0.1",
     "log4js": "cartodb/log4js-node#cdb",
     "lru-cache": "2.6.5",