I looked at 22 open source Node.js frameworks for building APIs and ranked the ones I'd pick. I checked what each one gives you beyond routing, such as validation, OpenAPI docs and a project structure, which runtimes it supports, and how many security fixes it shipped in the past year. Then I built the same REST API in seven of them, Express, Fastify, Hono, Koa, hapi, NestJS and AdonisJS, and load-tested each one on a single CPU core.
Rity Anand is a director of Geekflare. She has extensive experience managing business technology and a special interest in emerging technologies.
What I found
Fastify handled the most traffic on one CPU core, 19,918 reads and 12,288 writes a second, with Hono close behind at 18,397 and 10,867. Express managed 10,963 reads, about half of Fastify.
NestJS and the AdonisJS API starter were the heaviest. They took 1.1 and 1.3 seconds to start against under half a second for the rest, and the AdonisJS starter runs session, security and auth middleware on every request, which put it at 4,201 reads a second.
Hono installed only 4 packages including Zod, against 66 for Express with Zod and 104 for NestJS.
Express answered broken JSON with an HTML page and Koa and Hono with plain text, Fastify and hapi named only the first invalid field, and AdonisJS returned 422 rather than 400.
Tested on DigitalOcean Droplet with Ubuntu 24.04 server with 2 vCPU and 4 GB of RAM, using Docker. “Ready in” is installing the test app’s packages in an empty container, with any build step. “Memory at idle” is the app’s process after it starts, with no traffic. Each app has a health check, a read by ID from 100 items held in memory, and a create endpoint that validates a JSON body with the framework's usual validator. Each ran on Node.js 24.22 limited to one CPU core, while the oha load tester used the other core to send 50 concurrent connections for 20 seconds. Each figure is the median of three runs, and startup is the median of five, from launching the app to its first answer. These numbers show framework overhead. In a real API, database calls will usually take far longer than the framework.
The official API starter took 2 minutes to create and ran session, security and auth middleware on every request, which put it at 4,201 reads a second.
YesWebSocket helper per runtime; Node.js via @hono/node-server
PartlyOptional @hono/tsyringe DI middleware, no fixed layout
No
YesBuilt-in basic, bearer, JWT and JWK middleware
AdonisJS
Yes
YesVineJS, from the AdonisJS team
PartlyCommunity packages only
NoNode.js only
NoTransmit offers server-sent events, not WebSockets
YesIoC container and a fixed project layout
YesLucid SQL ORM
Yes@adonisjs/auth guards, Ally social login and Bouncer
Encore.ts
Yes
YesFrom TypeScript types, run in the Rust runtime
Partlyencore gen client --lang=openapi, marked experimental
PartlyNode.js; Bun only as an experiment flag
YesStreaming APIs over WebSocket
YesServices defined by encore.service.ts folders
YesPostgreSQL with migrations; bring your own ORM
YesAuth handlers run by the API gateway
Koa
PartlyTypes from @types/koa
PartlyOfficial koa-joi-router, last released 2021
PartlyCommunity packages only
NoNode.js only in the docs
PartlyCommunity packages only
No
No
Yeskoa-jwt and koa-session in the koajs org
Feathers
Yes
Yes@feathersjs/schema with TypeBox or JSON Schema
PartlyCommunity feathers-swagger only
NoNode.js in v5; Deno, Bun and Workers planned for v6
YesSocket.io transport in core packages
YesServices and hooks, with a generated project layout
YesKnex SQL, MongoDB and memory adapters
YesLocal, JWT and OAuth strategies
hapi
YesShips types with typed route refs
YesRoute validation with joi from the hapijs org
Partlyhapi-swagger is a community plugin
NoNode.js only
YesOfficial @hapi/nes plugin
PartlyPlugins and glue manifests; no fixed layout
No
YesCore auth strategies plus official jwt, cookie and bell
Elysia
Yes
YesTypeBox built in, plus Standard Schema libraries
YesOfficial @elysia/openapi plugin
YesBun first; Node.js, Deno, Workers via adapters
YesBuilt in on Bun; Node.js through @elysia/node
NoUnopinionated; feature folders are only a suggestion
NoGuides for Drizzle and Prisma
YesOfficial JWT and bearer plugins
Ask Sparkian
Which Node.js framework fits your project?
Describe the API you're building, the size of your team and where it will run, and AI will shortlist the best fits from these picks.
Recommended Node.js frameworks
Ranked on what a team needs to build and maintain an API including validation and docs from the project itself, types, structure as the codebase grows, how steadily it ships fixes, and how it did in my test.
#1Best overall for Node.js APIsTested by Geekflare
Node.js web framework with JSON Schema validation, a plugin system and built-in Pino logging
JSON Schema validation in the core and official plugins for OpenAPI, WebSockets and auth, and the most requests a second in my test. It shipped many security fixes this year, so stay on the latest patch.
Tested Oct 31, 2026, version 5.12.7
Ready in
4 s
Memory in use at idle
78 MB of 4 GB
Reads per second
19,918
Writes per second
12,288
Startup
0.44 s
The most requests a second in the test, 19,918 reads and 12,288 writes, with validation from a JSON Schema and no extra package.
TypeScript framework for Node.js servers with modules, dependency injection and decorators, on Express, Fastify or node:http
Modules and dependency injection give every team the same layout, with official packages for OpenAPI, WebSockets, microservices and the main ORMs. It asks for more code than the others and took over a second to start in my test.
Tested Oct 31, 2026, version 12.3.2
Ready in
10 s
Memory in use at idle
106 MB of 4 GB
Reads per second
8,182
Writes per second
5,268
Startup
1.13 s
Started in 1.1 seconds against under half a second for the lighter frameworks, and handled 8,182 reads a second on its default Express adapter.
Minimal web framework for Node.js with routing, middleware and HTTP helpers
The framework most Node.js developers already know, now on version 5 with async error handling and a huge range of middleware. Validation, OpenAPI and types all come from third-party packages.
Tested Oct 31, 2026, version 5.3.0
Ready in
4 s
Memory in use at idle
75 MB of 4 GB
Reads per second
10,963
Writes per second
7,270
Startup
0.46 s
About half of Fastify's throughput, at 10,963 reads a second. Malformed JSON got Express's default HTML error page, not JSON.
Small web framework built on Web Standards that runs the same code on Cloudflare Workers, Bun, Deno, Node.js and AWS Lambda
The same code runs on Cloudflare Workers, Bun, Deno, Lambda and Node.js, and it came close to Fastify in my test with only four packages installed. It's a toolkit, so structure and data access are up to you.
Tested Oct 31, 2026, version 4.13.14
Ready in
2 s
Memory in use at idle
80 MB of 4 GB
Reads per second
18,397
Writes per second
10,867
Startup
0.40 s
Close to Fastify at 18,397 reads a second, and the smallest install: 4 packages including Zod. The default validation error is awkward to read.
TypeScript MVC framework for Node.js with its own ORM, validator, auth, testing and CLI, for APIs and server-rendered apps
An ORM, validator, auth, testing and a CLI from one team, in the style of Laravel. Its API starter was the heaviest in my test, it needs Node.js 24, and there's no official OpenAPI package.
Tested Oct 31, 2026, version 7.6.0
Ready in
2 min
Memory in use at idle
133 MB of 4 GB
Reads per second
4,201
Writes per second
3,111
Startup
1.35 s
The official API starter took 2 minutes to create and ran session, security and auth middleware on every request, which put it at 4,201 reads a second.
TypeScript backend framework with a Rust runtime that declares databases, Pub/Sub and cron jobs in code and runs them locally
Declare databases, Pub/Sub and cron jobs in TypeScript and Encore runs them locally with tracing, while a Rust runtime handles HTTP. Having it provision them in AWS or GCP needs the paid Encore Cloud.
Best for
Teams building TypeScript microservices on AWS or GCP who want infrastructure declared in code
Not for
Teams that want a plain library they can drop into any Node.js server or edge runtime
+Requests validated from TypeScript types, no schema library
+encore run starts Postgres, Pub/Sub and caches locally
+Tracing with no instrumentation code, including on a laptop
+Docker images and a migrate-away guide limit lock-in
−Automatic cloud provisioning needs the paid Encore Cloud plan
−Static analysis sets rules on how code is written, and AWS and GCP only
−Two critical advisories in July 2026, fixed in 1.57.11 and 1.57.13
Small async middleware framework for Node.js from the team behind Express, with no bundled middleware
A small async middleware core that handled 23% more reads than Express in my test. Routing, body parsing and validation come from separate packages, and releases have slowed.
Tested Oct 31, 2026, version 3.2.1
Ready in
5 s
Memory in use at idle
82 MB of 4 GB
Reads per second
13,497
Writes per second
8,260
Startup
0.44 s
23% more reads a second than Express with the same Zod check, at 13,497. Routing and body parsing come from separate packages.
TypeScript framework for REST and real-time APIs built from services and hooks, with Socket.io events and database adapters
Services expose the same API over REST and WebSockets, with official adapters for SQL and MongoDB. Version 6 has been in pre-release since January 2026, and two maintainers do most of the work.
Best for
Teams building real-time APIs where clients should see changes as they happen
Not for
Teams that want OpenAPI docs from official packages or a large community around them
+Every service is available over REST and Socket.io with real-time events
+Hooks run the same for REST, WebSocket and internal calls
+Schemas give both validation and TypeScript types, plus a typed client
+Official adapters share one query syntax across SQL and MongoDB
−Several OAuth account-takeover advisories this year
−No official OpenAPI package; the community one was last published in 2023
−The next major version has been in pre-release since January 2026
Configuration-driven Node.js server framework with built-in auth, validation, caching and plugins
Routes declare validation, auth and limits as configuration, with joi from the same project, and every error in my test came back as JSON. A small volunteer committee maintains it.
Tested Oct 31, 2026, version 21.4.12
Ready in
9 s
Memory in use at idle
81 MB of 4 GB
Reads per second
10,111
Writes per second
5,421
Startup
0.48 s
Validation, errors and limits are route configuration, and every error came back as JSON. Writes were the second slowest at 5,421 a second.
TypeScript web framework built for Bun, with schema validation, OpenAPI docs and a typed client called Eden
Typed routes, validation, OpenAPI and a typed client from one schema, built for Bun with adapters for Node.js, Deno and Workers. Version 1.4 now gets security fixes only while version 2, a rewrite, is a release candidate.
Best for
TypeScript teams on Bun who want typed routes, validation and OpenAPI from one schema
Not for
Teams that want a long-stable API or Node.js as the main target
+Validation with TypeBox or any Standard Schema library
+OpenAPI docs from schemas or straight from TypeScript types
+Eden gives a typed client without code generation
−Critical security fixes in schema compilation in the past year
−1.4 is security-only while Elysia 2 is still a release candidate
−Some features follow Bun, and Workers support is experimental
Re-implementation of the Express 4 API on top of uWebSockets.js, meant as a drop-in replacement for Express
Apache-2.0
Permissive
Express-compatible web server
1.1k
(Actively maintained)Oct 2026
Actively maintained
Slowing: last release 1 to 2 years ago
Stale: no release in over 2 years
Not included, and why
Names from older lists that have stopped, front-end frameworks, and tools that aren't backend frameworks.
Total.js:The original framework repository was last updated in March 2024, and its successor, Total.js 5, is still at version 0.0.x with a small following.
micro:Vercel's micro has had no release since November 2022.
Next.js and Nuxt server routes:Features of meta-frameworks whose main job is rendering pages, not standalone backend frameworks.
Strapi:A headless CMS that gives you an API from content types, rather than a framework for writing your own.See open source CMS
How to choose
Start from how big the codebase will get
For a small service or a few endpoints, Fastify, Hono or Express keep things simple. When several teams will share one backend, NestJS, AdonisJS or Encore.ts give everyone the same structure, at the cost of more code and a slower start.
Check where it has to run
Hono, Elysia and h3 run on Cloudflare Workers, Bun and Deno as well as Node.js. Fastify, NestJS, Express, Koa, hapi and AdonisJS are Node.js frameworks, which is fine for a container or a server.
Count what you'd have to add
Fastify, NestJS, Hono and Elysia give you validation and OpenAPI docs from the project itself. With Express and Koa you choose and maintain third-party packages for both, and AdonisJS has validation but no official OpenAPI package.
Plan for patch releases
All ten picks shipped security fixes in the past year, many of them in validation, body parsing or auth middleware. Pin versions, watch each project's GitHub security advisories and update often, whichever framework you choose.
How we evaluate
No vendor influences these pages. A vendor can pay for a Featured placement, labelled Sponsored, which never changes a rank or a review.
What qualifies
Open source server-side frameworks for building HTTP APIs and microservices in JavaScript or TypeScript, with a release or commit in the last 12 months and 1,000+ GitHub stars. Front-end frameworks, meta-frameworks whose main job is rendering pages, headless CMSs and test frameworks are not considered.
Where we look
GitHub, the pages that rank for each category, so both established and newer projects are considered.
How we rank
Fit for business and technical teams: maintenance activity, self-hosting effort, licence terms, and which features the paid editions lock. Payment never changes a ranking.
Where the data comes from
Stars, releases, contributors and licences come from GitHub. Editions, pricing and requirements come from each software's own docs.
Hands-on testing
We install several of the picks in each category on a cloud Ubuntu 24.04 server (2 vCPU, 4 GB RAM) with Docker, and record install time and idle memory.
Questions
Frequently asked questions
No. Node.js is a JavaScript runtime. It runs JavaScript outside the browser and provides the HTTP server, file system and network APIs. Frameworks such as Express, Fastify and NestJS run on top of it and add routing, middleware, validation and structure.
For most new APIs, Fastify. It has schema validation in the core, official OpenAPI and auth plugins, and it was the fastest in my test. For a large TypeScript codebase shared by several teams, NestJS. For code that must also run on Cloudflare Workers, Bun or Deno, Hono.
Express has the most developers and middleware, but validation, OpenAPI and types come from other packages. Fastify adds validation and official plugins for those, and handled 19,918 reads a second on one core in my test against 10,963 for Express. Hono did 18,397 with only four packages and runs beyond Node.js, but you assemble more of the app yourself.
Yes, for teams that know it. Express 5 handles errors from async handlers, both the 5.x and 4.x lines still get releases, and it's an OpenJS Foundation project. For a new API, Fastify or Hono give you validation and better types with less to add.
In my test, Fastify, at 19,918 reads a second on one CPU core, then Hono at 18,397, Koa at 13,497 and Express at 10,963. The gap matters less than it looks, because a single database query usually takes longer than the framework's own work on a request.
NestJS
Express
Hono
AdonisJS
Koa
hapi
Ask Sparkian
