app.handle() in lib/application.js creates a finalhandler instance as the terminal done callback when no user-provided callback is passed, configured with { env: this.get('env'), onerror: logerror.bind(this) }. The logerror function in lib/application.js calls console.error(err) only when env is not 'test', suppressing error logging noise during test runs. finalhandler (not Express itself) renders the full error stack in response body during development mode and omits stack traces in production; Express delegates error-rendering to this package and contains no fallback error-rendering logic.
Express depends on body-parser for JSON, URL-encoded, and raw request body parsing; applications using Express's built-in body parsing should ensure a remediated version of body-parser is in use to address any associated vulnerabilities in that package.