StackPrism

Backend framework

Express: supported versions and open vulnerabilities today

Express 5 and 4 are supported; 3 reached end of life on Jul 5, 2015; the latest release is 5.3.0. No advisories for Express were published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities.

Last checked against endoflife.date, npm, OSV.dev, CISA KEV and deps.dev.

Check my repoDesign a stack with Express
Latest release
5.3.0
npm downloads last week
145.2M
GitHub stars
69.6k
Licence
MIT
OpenSSF Scorecard
8.5 / 10

Supported versions

Data: endoflife.date
Express release lines and security support dates from endoflife.date
VersionSecurity supportLatestReleased
Express 5Supported: No end date announced5.3.0
Express 4Supported: No end date announced4.22.3
Express 3Ended: Ended 3.21.2
Express 2Ended: Ended 2.5.11
Express 1Ended: Ended 1.0.9

Security advisories

OSV.dev, CISA KEV and FIRST EPSS

No advisories published in the last 12 months. 5 in total since records began. Checked packages: express.

All express advisories on OSV.dev

Maintenance and supply chain

OpenSSF Scorecard 8.5 / 10 (scored )

The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 17 commits and 2 issue updates found in the last 90 days.

Weakest checks

  • No fuzzing (Fuzzing 0/10)
  • No OpenSSF best-practices badge (CII-Best-Practices 0/10)

Full ScorecardSource repository

Production checklist

Express production checklist: 7 checks before launch

  • Should do: Follow the Express production security checklist
  • Should do: Set security headers with Helmet
  • Should do: Set secure and httpOnly on session cookies and rename the default cookie
See all 7 checks with how to verify each

Alternatives

  • Kong

    Cloud-native API gateway built on Nginx

    Strengths

    • High performance
    • Rich plugin ecosystem

    Trade-offs

    • Complex for simple use cases
    • Enterprise features require license
    Kong health today

  • AWS API Gateway

    Fully managed API gateway service

    Strengths

    • Fully managed
    • Deep AWS integration

    Trade-offs

    • AWS vendor lock-in
    • Limited customization
    AWS API Gateway health today

  • Apigee

    Enterprise API management platform by Google

    Strengths

    • Comprehensive API analytics and monitoring
    • Advanced developer portal capabilities

    Trade-offs

    • Complex setup and configuration
    • Overkill for small-scale API needs

  • Tyk

    Open-source API gateway with GraphQL support

    Strengths

    • Open-source with self-hosting option
    • Native GraphQL federation support

    Trade-offs

    • Smaller community compared to Kong
    • Limited plugin ecosystem

Docs and release notes

Check Express in your own stack

This page checks Express in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.

Check my repoDesign a stack with Express