diff --git a/CHANGES.md b/CHANGES.md
index dce35c4..155395f 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,5 +1,7 @@
 ### Next version
 
+* Replace express-brute with rate-limiter-flexible (fixes GHSA-984p-xq9m-4rjw).
+
 ### 4.0.1
 
 * Fixed proxied upstream POST request being aborted when the stream associated with the downstream request is closed on Node v16+. This will now again correctly be triggered only when the socket is closed early.