Express.js

This content was generated with the assistance of AI and should be verified against the official documentation before being relied on in production.

The reference material consulted while preparing these pages is listed in the section bibliography.

This section is written against Express 5.3 (5.3.0, released 2026-10-09, the latest release) running on Node.js 24 and 26, with the differences of Express 4.22 (4.22.3, in maintenance) called out wherever they matter. Express 5 requires Node.js 18 or later; Express 4 runs on very old Node.js lines. The versions were checked on 2026-10-29. Express 5.0 shipped in 2024, 5.1.0 (2025-03-31) became the default latest release, and the 5.x line keeps receiving monthly security and bug-fix releases, so each page says which version introduced, changed or removed a behaviour. No Express 6 has been announced, and the section documents only what the current releases do.

What Express is

Express is the minimal, unopinionated web framework for Node.js. It is a thin layer over node:http: it adds a router, a middleware pipeline, a richer request and response, view rendering and a handful of conventions, and leaves everything else (validation, persistence, authentication, project layout) to you and to the ecosystem. Most of the work is done by small, separately versioned modules: router and path-to-regexp for routing, body-parser for request bodies, serve-static and send for files, finalhandler for the last response, and proxy-addr for proxy trust. It is an OpenJS Foundation project and, years after its first release in 2010, the framework most other Node.js frameworks are measured against or built on, including NestJS through its default HTTP platform.

This section is for developers who:

  • know some JavaScript or TypeScript and want to learn Express properly, beyond copy-pasted tutorials

  • know the Node.js runtime (see the Node.js section) and want the framework layer on top

  • come from Spring Boot, Django, Flask, FastAPI or ASP.NET and want to compare an unopinionated stack with an opinionated one

  • maintain Express 4 code, or follow books and tutorials that target it, and need to know what changed in Express 5

The Bookshelf scenario

Every example builds Bookshelf, the same domain used by the Node.js, NestJS, FastAPI and Next.js sections, so the stacks can be compared. It starts as a hello-world app and grows into a bookshelf-api JSON API (/api/v1/books, /reviews and /authors) with validation, problem-details errors, pagination and filtering. It persists data with node:sqlite first, then PostgreSQL through pg or Prisma and MongoDB through Mongoose. It adds a server-rendered admin area with a template engine, sessions and Passport login, JWT-protected endpoints with CORS for a single-page application, cover uploads with multer and downloads with res.download, a GraphQL endpoint, a live "new review" feed over Server-Sent Events and Socket.IO, supertest and node:test suites, a Dockerfile, health checks and graceful shutdown. Pages build on each other, but each can be read on its own.

Diagram of the Bookshelf components: clients, a reverse proxy, the Express app, databases, uploads, real time, tests and production
Figure 1. The Bookshelf components built across the section

Reading path

The pages are ordered so that each one builds on the previous ones:

  1. Foundations: what Express is, versions and support, getting started, TypeScript, project structure

  2. Routing: routes, route paths and parameters, routers and modular apps

  3. Middleware: how middleware works, body parsing, the official middleware modules

  4. Application, request and response: settings, req, res, content negotiation and HTTP caching

  5. Static files and views: express.static, template engines

  6. Errors, debugging and logging: error handling, debug, request logging

  7. APIs and data: REST design, validation, databases, MongoDB and Mongoose, uploads and downloads

  8. Integrations: GraphQL, WebSockets and Server-Sent Events, SPAs and server-side rendering

  9. Security: best practices, cookies and sessions, authentication and authorization, CORS

  10. Testing: supertest, node:test, in-memory databases and end-to-end tests

  11. Production: performance, proxies, health checks and graceful shutdown, containers

  12. Migration and beyond: Express 5 migration, extending the API, frameworks built on Express

mindmap root((Express)) Foundations Architecture Versions and LTS Getting started TypeScript Project structure Routing Routes Paths and params Routers Middleware Fundamentals Body parsing Official modules App request response Settings req res Negotiation and caching Static files and views express.static Template engines Errors and debugging Error handlers debug Logging APIs and data REST Validation Databases Mongoose Uploads Integrations GraphQL WebSockets and SSE SPAs and SSR Security Best practices Sessions Authentication CORS Testing supertest node:test Production Performance Proxies Health checks Containers Migration Express 5 Extending Alternatives
Figure 2. Mind-map of the topics covered in this section

The official examples

The expressjs/express repository ships 25 runnable applications in its examples directory (described on the official examples page). Each is explained, modernised for Express 5 and mapped to the Bookshelf scenario on the page below. The Getting Started page shows how to run them.

Example What it demonstrates Explained on

auth

Session-based login with hashed passwords and a restricted page

Authentication & Authorization

content-negotiation

res.format() serving HTML, text or JSON from one route

Content Negotiation & HTTP Caching

cookie-sessions

Client-side sessions stored in a signed cookie

Cookies & Sessions

cookies

Reading, setting and clearing cookies

Cookies & Sessions

downloads

res.download and file-serving routes

Serving Static Files

ejs

Server-rendered pages with the EJS template engine

Template Engines & Views

error

An error-handling middleware that formats errors

Error Handling

error-pages

Custom 404 and 500 pages

Error Handling

hello-world

The smallest possible Express application

Getting Started with Express

markdown

Registering a custom view engine for Markdown files

Template Engines & Views

multi-router

Several routers mounted on one application

Routers & Modular Apps

mvc

Controllers, models and views in separate folders

Project Structure and Configuration

online

Tracking online users and a long-lived stream

Real Time: WebSockets, Socket.IO and Server-Sent Events

params

app.param() and route parameters

Routing

resource

A resource-style route set for a collection

Routing

route-map

Declaring routes from a map of paths and handlers

Project Structure and Configuration

route-middleware

Route-level middleware chains and next('route')

Routing

route-separation

Routes split into separate modules

Project Structure and Configuration

search

A small search API with query parameters

Building REST APIs with Express

session

Server-side sessions with express-session

Cookies & Sessions

static-files

Mounting several static directories

Serving Static Files

vhost

Host-based routing with the vhost middleware

Routers & Modular Apps

view-constructor

A custom View class for loading templates

Template Engines & Views

view-locals

Passing data to views with res.locals and res.render

Template Engines & Views

web-service

A JSON web service secured with API keys

Building REST APIs with Express

Existing pages are linked rather than repeated; the Express pages add only the framework layer.

Existing page(s) How it relates to this section

Node.js, HTTP Server Fundamentals, Server Timeouts, Limits & Hardening

The runtime underneath Express. The Node.js section owns the event loop, node:http, streams, the test runner and hardening; the Express pages own only the framework layer.

Web Frameworks: Express & Fastify

A one-page Express 5 overview next to Fastify. It stays the overview and the place for the Fastify comparison.

NestJS, Fastify & HTTP Platforms

NestJS, whose default HTTP platform is Express. Linked from the frameworks page.

Backend Frameworks Comparison

Popularity, ecosystem and radar charts that include Express.

Starting a New Project

Backend framework choice, including JavaScript and TypeScript on Node.js.

CORS

CORS theory. The Express CORS page shows only the cors middleware.

OAuth

OAuth, OpenID Connect and JWT theory, linked from the authentication page.

GraphQL

GraphQL theory, serving over HTTP and demand control, linked from the GraphQL page.

WebRTC & WebSockets

Socket.IO and the WebSocket protocol, linked from the real-time page.

MongoDB, SQL, Pagination Strategies

Engines, drivers and pagination. The database pages show only how to use them from Express.

React, Vue, Angular, Next.js

The front ends that pair with Express, linked from the SPA and SSR page.

Docker, Kubernetes

Containers and probes, linked from the deployment and health-check pages.

JavaScript, TypeScript

The languages, linked for syntax.

Bibliography

Every source used to generate this section, each linked to its official website. Individual pages list the subset they derive from under their own == References heading. The books below were consulted for concept coverage, narrative and structure only; every code example is written against the current official documentation, which wins wherever a book differs, and each page says where a book is outdated.

Books

  • Aneeta Sharma, Full-Stack Web Development with Vue.js and Node, Packt Publishing, 2018, ISBN 978-1-78883-114-7 (print): Packt page

  • Fernando Monteiro, Learning Single-page Web Application Development, Packt Publishing, 2014, ISBN 978-1-78355-209-2 (print): Packt page

  • Daniel Bugl, Modern Full-Stack React Projects, Packt Publishing, 2024, ISBN 978-1-83763-795-9 (print): Packt page

  • Fernando Monteiro, Node.js 6.x Blueprints, Packt Publishing, 2016, ISBN 978-1-78588-843-4 (print): Packt page

Each book also has a companion-code repository on the publisher’s GitHub organization, PacktPublishing, which was used only to understand the scope of the projects.