Web frameworks
Express has 2 supported release lines; endoflife.date doesn’t track NestJS. Both are open source under the MIT licence. OSV.dev lists 1 advisory from the last 12 months for NestJS and none for Express.
Last checked against endoflife.date, npm, deps.dev, OSV.dev and CISA KEV.
Every value links to its source. Where a row doesn’t apply to one of them, the cell says why.
| Compared on |  Express |  NestJS |
|---|---|---|
| Support and releases | ||
| Supported release lines | Not tracked by endoflife.date | |
| Latest release | ||
| Releases in the last 12 months | ||
| Security | ||
| Advisories published in the last 12 months | ||
| OpenSSF Scorecard | ||
| Licence and hosting | ||
| Licence | ||
| How you run it | Your own Node.js server | Your own Node.js server |
| Adoption | ||
| npm downloads last week | ||
| GitHub stars | ||
| Express | NestJS |
|---|---|
| Supported release lines | |
Not tracked by endoflife.date | |
| Latest release | |
| Releases in the last 12 months | |
| Express | NestJS |
|---|---|
| Advisories published in the last 12 months | |
| OpenSSF Scorecard | |
| Express | NestJS |
|---|---|
| Licence | |
| How you run it | |
Your own Node.js server | Your own Node.js server |
| Express | NestJS |
|---|---|
| npm downloads last week | |
| GitHub stars | |
Read across for what matters to you. Each answer comes from the data above or the project’s licence and hosting options.
| If you need | Express | NestJS |
|---|---|---|
| An open-source licence | Yes: MIT | Yes: MIT |
| A long support window | No end dates published | Not tracked by endoflife.date |
| The language your team writes | JavaScript (Node.js) | TypeScript (Node.js) |
| Express | NestJS |
|---|---|
| An open-source licence | |
Yes: MIT | Yes: MIT |
| A long support window | |
No end dates published | Not tracked by endoflife.date |
| The language your team writes | |
JavaScript (Node.js) | TypeScript (Node.js) |
Minimal Node.js web framework
Structured Node.js framework with modules, dependency injection and decorators
From StackPrism’s curated notes. Pricing isn’t covered here: it changes often, so check each vendor’s pricing page.
NestJS is built on top of Express (or Fastify) and adds modules, dependency injection and decorators, so the choice is about structure: Express leaves the architecture to you, while NestJS gives a large codebase one consistent shape.
Release lines and end-of-life dates come from endoflife.date, release counts from deps.dev’s publish dates, and advisories from OSV.dev, counted once per flaw even when it’s listed under several ids, and checked against CISA’s list of vulnerabilities known to be exploited. Status and incident history come from each vendor’s public status feed; licences from each project’s licence file or the vendor’s licensing page, linked in the table.
The data refreshes every few hours and the time it was checked is shown above. There’s no pricing and no overall winner: which one fits depends on your constraints. To see how the versions you actually run hold up, check your repo.
Paste a public GitHub repo and see what’s vulnerable, end of life or deprecated in it today. Free, no sign-up.