diff --git a/install/package.json b/install/package.json
index 630102b798..efdf151897 100644
--- a/install/package.json
+++ b/install/package.json
@@ -35,7 +35,7 @@
         "autoprefixer": "10.4.2",
         "bcryptjs": "2.4.3",
         "benchpressjs": "2.4.3",
-        "body-parser": "1.19.1",
+        "body-parser": "1.19.2",
         "bootbox": "5.5.2",
         "bootstrap": "3.4.1",
         "chalk": "4.1.2",
@@ -118,7 +118,7 @@
         "sanitize-html": "2.7.0",
         "semver": "7.3.5",
         "serve-favicon": "2.5.0",
-        "sharp": "0.30.1",
+        "sharp": "0.30.2",
         "sitemap": "7.1.1",
         "slideout": "1.0.1",
         "socket.io": "4.4.1",
diff --git a/src/controllers/users.js b/src/controllers/users.js
index 818cb86123..ee57bf1afe 100644
--- a/src/controllers/users.js
+++ b/src/controllers/users.js
@@ -148,14 +148,22 @@ usersController.getUsers = async function (set, uid, query) {
 usersController.getUsersAndCount = async function (set, uid, start, stop) {
 	async function getCount() {
 		if (set === 'users:online') {
-			return await db.sortedSetCount('users:online', Date.now() - (meta.config.onlineCutoff * 60000), '+inf');
+			return await db.sortedSetCount('users:online', Date.now() - 86400000, '+inf');
 		} else if (set === 'users:banned' || set === 'users:flags') {
 			return await db.sortedSetCard(set);
 		}
 		return await db.getObjectField('global', 'userCount');
 	}
+	async function getUsers() {
+		if (set === 'users:online') {
+			const count = parseInt(stop, 10) === -1 ? stop : stop - start + 1;
+			const uids = await db.getSortedSetRevRangeByScore(set, start, count, '+inf', Date.now() - 86400000);
+			return await user.getUsers(uids, uid);
+		}
+		return await user.getUsersFromSet(set, uid, start, stop);
+	}
 	const [usersData, count] = await Promise.all([
-		user.getUsersFromSet(set, uid, start, stop),
+		getUsers(),
 		getCount(),
 	]);
 	return {