express

library5.2.1jsnpmunverified

Express.js is a fast, unopinionated, and minimalist web framework for Node.js, providing a robust set of features for building web and mobile applications. The current stable major version is 5.2.1, with the 4.x branch (currently 4.22.1) also actively maintained for security and critical fixes. Releases are frequent, often addressing security vulnerabilities or updating internal dependencies. Express differentiates itself through its flexible middleware-based architecture, allowing developers to build APIs and web servers with significant control and without being locked into a rigid structure, contrasting with more opinionated frameworks. It is widely adopted and serves as a foundational component for many other Node.js frameworks, emphasizing simplicity and modularity.

web-framework http-networking

npm install express

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · EXPRESS

express

web-frameworkjavascriptv5.2.1

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

express

✓ import express from 'express';

✗ const express = require('express'); // For ESM environments without babel/ts-node setup

For CommonJS, use `const express = require('express');`. For ESM, default import is standard.

Router

✓ import { Router } from 'express';

✗ import Router from 'express/lib/router'; // Internal path, not public API

Router is a named export for creating modular, mountable route handlers.

Request, Response, NextFunction

✓ import { Request, Response, NextFunction } from 'express';

✗ import { Express, Request, Response } from 'express'; // 'Express' itself is the default export type, not a named export value

These are common TypeScript types for middleware and route handlers, useful for strong typing your Express applications.

express

✓ const express = require('express');

Standard CommonJS import pattern, widely used in Node.js applications.

This quickstart demonstrates a basic Express v5 server with JSON body parsing, custom logging middleware, defined routes, and comprehensive error handling, showcasing typical setup for a web API.

import express, { Request, Response, NextFunction } from 'express'; const app = express(); const PORT = process.env.PORT ? parseInt(process.env.PORT, 10) : 3000; // Middleware to parse JSON bodies app.use(express.json()); // Simple logging middleware app.use((req: Request, res: Response, next: NextFunction) => { console.log(`[${new Date().toISOString()}] ${req.method} ${req.url}`); next(); }); // Define a root route app.get('/', (req: Request, res: Response) => { res.send('Hello from Express v5!'); }); // Define a route with a parameter app.get('/users/:id', (req: Request, res: Response) => { const userId = req.params.id; res.json({ message: `User ID: ${userId}` }); }); // Handle undefined routes app.use((req: Request, res: Response) => { res.status(404).send('Not Found'); }); // Global error handler app.use((err: Error, req: Request, res: Response, next: NextFunction) => { console.error(err.stack); res.status(500).send('Something broke!'); }); // Start the server app.listen(PORT, () => { console.log(`Server listening on port ${PORT}`); console.log(`Access it at http://localhost:${PORT}`); });

Debug

Known issues

breakingExpress v5 introduces breaking changes by dropping support for older Node.js versions. Applications must run on Node.js >= 18 to be compatible with Express v5. This allows for more modern JavaScript features and improved performance.

fix

Upgrade your Node.js runtime environment to version 18 or higher before upgrading to Express v5.

affects: >=5.0.0

breakingVersions 5.2.0 and 4.22.0 included an erroneous breaking change related to the extended query parser, causing unexpected behavior in how URL query strings were parsed. This change was swiftly reverted in subsequent patch releases.

fix

Immediately upgrade to Express 5.2.1 or 4.22.1 to revert the query parser behavior to its stable state. Avoid using versions 5.2.0 and 4.22.0.

affects: 5.2.0, 4.22.0

deprecatedThe use of the magic string 'back' in `res.redirect('back')` was deprecated in Express v4.21.0. While still functional, it's recommended to move away from this pattern for better explicitness and control.

fix

Replace `res.redirect('back')` with explicit URLs or manage redirect paths more directly within your application logic.

affects: >=4.21.0

gotchaExpress v5 significantly refined how asynchronous errors are handled within middleware and route handlers. While previous versions could sometimes implicitly catch promise rejections, v5 requires explicit error handling, often through `next()` with an error argument, or by wrapping async handlers in a `try...catch` block that calls `next(err)`.

fix

Ensure all asynchronous route handlers and middleware either use `try...catch` blocks to pass errors to `next(err)`, or use an `express-promise-router` or similar utility to automatically catch unhandled promise rejections.

affects: >=5.0.0

securityCVE-2024-47764 addressed a security vulnerability related to cookie parsing. Older versions of Express, or its underlying `cookie` dependency, may be susceptible.

fix

Upgrade to Express 5.0.1 or 4.21.1 (or newer patch versions) to ensure you have the fix for CVE-2024-47764.

affects: <5.0.1, <4.21.1

gotchaWhile CVE-2024-51999 concerning the extended query parser was ultimately rejected as a security vulnerability, the attempted 'fix' in Express 5.2.0 and 4.22.0 introduced a breaking change in query parsing behavior. This led to functional issues rather than security exploits, requiring immediate reversion.

fix

Do not use Express 5.2.0 or 4.22.0. Ensure you are on 5.2.1, 4.22.1, or a later stable release to avoid the unintended query parser change.

affects: 5.2.0, 4.22.0

Errors

Common errors & fixes

Error: Cannot find module 'express'

The 'express' package has not been installed or is not resolvable in the current project context.

fix

Run `npm install express` or `yarn add express` in your project directory. If using a monorepo, check workspace configuration.

TypeError: app.use() requires a middleware function but got a undefined

You passed `undefined` to `app.use()` (or `Router.use()`) instead of a valid middleware function. This often happens due to incorrect imports or syntax errors in middleware definitions.

fix

Verify that the function or module you are passing to `app.use()` is correctly imported and exported, and that it is indeed a function. For example, ensure you are not doing `app.use(myMiddleware.middlewareName)` when `middlewareName` is `undefined`.

ReferenceError: express is not defined

The `express` module was not correctly imported or required before use.

fix

Ensure you have `const express = require('express');` (CommonJS) or `import express from 'express';` (ESM) at the top of your file where you intend to use `express`.

Error: Can't set headers after they are sent to the client.

Your application is attempting to send a response (e.g., `res.send()`, `res.json()`, `res.redirect()`) after headers have already been sent to the client. This typically occurs when multiple response-sending operations are triggered for a single request, or after `next()` is called when a response has already been sent.

fix

Always ensure that only one response is sent per request. Use `return` after sending a response (e.g., `return res.send('Done');`) to prevent further execution that might inadvertently send another response. Review asynchronous code paths to prevent multiple `res.send()` or `next()` calls.

Upgrade

Version history

5.2.1latest on npm

Audit

Dependencies

body-parseroptionalCommonly used for parsing request bodies (JSON, URL-encoded). While not a direct peer dependency, it's almost always used alongside Express.

qsrequiredUsed for parsing URL query strings. Express relies on this internally, and its version is sometimes noted in release logs due to security updates or specific parsing behavior.

cookierequiredUsed for parsing and setting HTTP cookies. Security updates to this dependency have impacted Express releases.

Agent activity

41 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/expressjs/express ↗

packagehttps://www.npmjs.com/package/express ↗

homepagehttps://expressjs.com ↗