Web frameworks

Django vs Flask

Django has 3 supported release lines; endoflife.date doesn’t track Flask. Django 4.2 reached end of life on Apr 7, 2026. Both are open source under the BSD-3-Clause licence. OSV.dev lists 30 advisories from the last 12 months for Django and 1 for Flask.

Last checked Oct 17, 2026, 06:25 UTC against PyPI, deps.dev, endoflife.date, OSV.dev and CISA KEV.

Check my repo Design a stack with either

Side by side

Every value links to its source. Where a row doesn’t apply to one of them, the cell says why.

Django and Flask compared on live data
Compared on	Django	Flask
Support and releases
Supported release lines	3 lines: 6.1, 6.0, 5.2 LTS Next to end: 6.0 on Apr 30, 2027 endoflife.date	Not tracked by endoflife.date
Latest release	`6.1.2` Released Oct 6, 2026 endoflife.date	`3.1.3` Released Feb 19, 2026 PyPI
Releases in the last 12 months	31 releases `django` on PyPI PyPI	1 release `flask` on PyPI PyPI
Security
Advisories published in the last 12 months	30, worst rated critical For `django` OSV.dev	1, worst rated low For `flask` OSV.dev
OpenSSF Scorecard	6.7 / 10 `django/django`, Aug 24, 2026 Scorecard	7.1 / 10 `pallets/flask`, Aug 24, 2026 Scorecard
Licence and hosting
Licence	BSD-3-Clause Open source (permissive) deps.dev	BSD-3-Clause Open source (permissive) deps.dev
How you run it	Your own Python app server (WSGI or ASGI)	Your own Python app server (WSGI)
Adoption
GitHub stars	91.4K `django/django` GitHub	75K `pallets/flask` GitHub

Support and releases
Django	Flask
Supported release lines
3 lines: 6.1, 6.0, 5.2 LTS Next to end: 6.0 on Apr 30, 2027 endoflife.date	Not tracked by endoflife.date
Latest release
`6.1.2` Released Oct 6, 2026 endoflife.date	`3.1.3` Released Feb 19, 2026 PyPI
Releases in the last 12 months
31 releases `django` on PyPI PyPI	1 release `flask` on PyPI PyPI

Security
Django	Flask
Advisories published in the last 12 months
30, worst rated critical For `django` OSV.dev	1, worst rated low For `flask` OSV.dev
OpenSSF Scorecard
6.7 / 10 `django/django`, Aug 24, 2026 Scorecard	7.1 / 10 `pallets/flask`, Aug 24, 2026 Scorecard

Licence and hosting
Django	Flask
Licence
BSD-3-Clause Open source (permissive) deps.dev	BSD-3-Clause Open source (permissive) deps.dev
How you run it
Your own Python app server (WSGI or ASGI)	Your own Python app server (WSGI)

Adoption
Django	Flask
GitHub stars
91.4K `django/django` GitHub	75K `pallets/flask` GitHub

Advisory counts cover every version, old ones included, and a heavily used, well-audited project often has more. Check the versions you run with the dependency check.

Which fits your constraints

Read across for what matters to you. Each answer comes from the data above or the project’s licence and hosting options.

How Django and Flask fit common constraints
If you need	Django	Flask
An open-source licence	Yes: BSD-3-Clause	Yes: BSD-3-Clause
A long support window	5.2 LTS is supported until Apr 30, 2028	Not tracked by endoflife.date

How Django and Flask fit common constraints
Django	Flask
An open-source licence
Yes: BSD-3-Clause	Yes: BSD-3-Clause
A long support window
5.2 LTS is supported until Apr 30, 2028	Not tracked by endoflife.date

What each is good at

Django

High-level Python web framework with batteries included

Strengths

Comprehensive built-in features (ORM, admin, auth)
Secure by default (CSRF, SQL injection protection)
Excellent documentation and large community
Rapid development with code generation
Scalable for large applications

Trade-offs

Monolithic and opinionated
Slower than lightweight frameworks
Learning curve for beginners
Overkill for small APIs

Common uses

Content management systems
E-commerce platforms
Data-driven web apps
Enterprise applications

Flask

Lightweight Python micro framework: routing and templates, the rest via extensions

Strengths

Small core that is quick to learn
Pick your own ORM, auth and validation libraries
Large extension ecosystem (Flask-SQLAlchemy, Flask-Login)
Mature and stable (first released in 2010)

Trade-offs

No built-in ORM, admin or authentication
WSGI-based: async views are supported, but each request still holds a worker
No built-in request validation
Larger apps need their own structure conventions

Common uses

Small web apps
REST APIs
Prototypes
Internal tools

From StackPrism’s curated notes. Pricing isn’t covered here: it changes often, so check each vendor’s pricing page.

When teams weigh these two

Django ships with an ORM, an admin, authentication and templates; Flask is a micro framework that gives you routing and templates and leaves the rest to extensions you pick. Both are mature, so the choice is mostly how much structure you want from day one.

How this comparison works

Release lines and end-of-life dates come from endoflife.date, release counts from deps.dev’s publish dates, and advisories from OSV.dev, counted once per flaw even when it’s listed under several ids, and checked against CISA’s list of vulnerabilities known to be exploited. Status and incident history come from each vendor’s public status feed; licences from each project’s licence file or the vendor’s licensing page, linked in the table.

The data refreshes every few hours and the time it was checked is shown above. There’s no pricing and no overall winner: which one fits depends on your constraints. To see how the versions you actually run hold up, check your repo.

Already using one of them?

Paste a public GitHub repo and see what’s vulnerable, end of life or deprecated in it today. Free, no sign-up.

Check my repo Design a stack