From the req.query doc, we know Express framework uses the qs package as its default query parser.
A very popular query string parser is the qs module, and this is used by default.
The default value of query parser application setting is "extended", see #app.settings.table, it will use the qs module as its query parser.
Let's take a look the source code, express compile the query parse at this line 4.18.2/lib/utils.js#L200
The parseExtendedQueryString implementation:
function parseExtendedQueryString(str) {
  return qs.parse(str, {
    allowPrototypes: true
  });
}
As you can see, it uses the qs module to parse the query string.
Let's go back to your question, ?key=C3363&token=abc+TI4 query string is invalid in the first place because the + sign is special in a query string.
+ sign has a semantic meaning in the query string. It is used to represent a space.
For more information, see this question Plus sign in query string
So, if you want to keep the + sign as a part in the parsed value, you need to encode the query string using encodeURIComponent like this before sending the HTTP request:
const obj = qs.parse(`key=C3363&token=${encodeURIComponent('abc+TI4')}`)
console.log(obj); // {key: "C3363", token: "abc+TI4"}