Express: Node.js application framework

Learn how Express adds routing and middleware to Node.js, where it fits in web applications and APIs, and which responsibilities remain with the developer.

Updated 8 September 2026

What Express does

Express is a minimal web application framework for Node.js. It supplies routing, HTTP utilities and a middleware model while leaving many architectural choices to the application. It can serve web pages or provide an API for other clients.

A small service might accept a request, validate its input, retrieve a record and return JSON. Express organizes the request path, while the project selects the database library and defines the actual business rules.

Routes and middleware

Middleware extends request handling with reusable behaviour. Its order and error handling form part of the application design, especially when authentication or body parsing must happen before a route executes.

For example, a public health endpoint and an authenticated account endpoint should not accidentally inherit the same access assumptions. Grouping routes deliberately makes those boundaries easier to maintain.

What to add around Express

Plan validation, authentication, logging and production process management explicitly. A small framework reduces the amount imposed by the core, but it also means the team owns more integration decisions.

Test failed dependencies and invalid input as well as successful requests. If an API calls an external service, define what users see when that service times out and how the application avoids leaving a partially completed operation.

How DNSTrace.dev detects Express

Detection reads the final HTTPS response and the first bytes of its markup. One matching signal is reported as strong evidence; two or more independent signals are reported as confirmed.

x-powered-by: Express — Emitted by default and removed with a single configuration line, so its absence proves nothing.

What a detection proves

The response was produced by an Express application, or by a framework built on top of Express that did not disable the header.

What it does not prove

Which higher-level framework is in use, the Node.js version or the hosting platform. Many frameworks build on Express and inherit this header.

Common questions about Express

Does Express include a database or full CMS?

No. Express provides web routing and middleware facilities. Applications add their own database integration, content management and other business-specific components.

Is x-powered-by: Express a security problem?

It is minor information disclosure rather than a vulnerability. It is commonly disabled because it offers no benefit to visitors.

Why do so many APIs show Express?

Express is a default choice for Node.js services and the header is on unless explicitly turned off, so it surfaces on endpoints that expose no other framework signal.

Application framework