A minimal web framework for Node.js.
Where It Sits
The small stack marks its layer. Beside it, each related technology links to its own page.
- App
- FrameworkExpress
- Web Server
- Runtime
- Containers
- OS
- Hypervisor
- Firmware
- Hardware
- Data
About
Express is a small, widely used framework for building web services in Node.js. It handles routing and middleware and little else, so teams add their own libraries. It runs on the Node.js runtime, often behind nginx.
How to Spot It
These are signs that a system runs Express, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.
- Response header
X-Powered-By: Express- Cookie
connect.sid
If It Has a Flaw
Express itself is small, so most risk comes from the application's own code and the npm packages it adds, outside code from the npm registry. A flaw in that code reaches what the one application can touch, while a flaw in Express reaches every app built with it.
Every app built with it is exposed.
Rivals
Rivals do the same job on the same layer, so a system usually runs one of them in any one place. A flaw in a rival does not reach Express.
Stacks and Code
Express is part of the common stacks below, and each stack's page shows who runs every layer. Its code arrives from the sources listed, and each source's page says how bad code could get in through it.
- In Common Stacks
- A Node.js App Behind nginxA Containerised App on Kubernetes
- Its Code Comes From
npmCI and Build Systems