Fun facts

Small, mostly-true things about the expressjs/express codebase.

The whole framework fits in 81 lines

lib/express.js — the file that defines the express module — is just 81 lines. The bulk of the work happens in dependencies. Strip the comments and license headers and the entire "what is Express" answer fits on one screen.

The largest file is the response

lib/response.js is over 1,000 lines. The next-biggest file (lib/application.js) is two-thirds the size. The reason: the response object is where most user-facing helpers live (send, json, jsonp, sendFile, download, cookie, redirect, render, format, attachment, links, vary, type, set, status, ...).

TJ's email is in roughly 60% of all commits

Of 6,139 total commits, 3,880 are authored by tj@vision-media.ca. The next-most prolific is Douglas Christopher Wilson (1,230). After that, the long tail drops sharply.

385 unique author emails

Open-source breadth: 385 distinct author email addresses have landed at least one commit since 2009. Most appear exactly once.

The app is a function — and an event emitter — and an object

createApplication() returns a function (req, res, next) whose own properties are the merged EventEmitter and application prototypes (via the merge-descriptors package). So you can write app.on('mount', ...), app.use(...), and http.createServer(app) — all on the same callable. This trick has been there essentially since the start.

A self-rejecting CVE

5.2.0 (2025-12-01) shipped a fix for CVE-2024-51999. The same day, 5.2.1 reverted it because the CVE was rejected and the "fix" was a breaking change to the extended query parser. The History.md entry preserves this two-step in detail — a small reminder to read advisories carefully.

The Buffer global is forbidden

ESLint config (.eslintrc.yml) flags any use of the global Buffer with the message "Use import { Buffer } from 'node:buffer' instead of the global Buffer." This is an in-house preference; both forms work at runtime but the explicit import is clearer about its source.

CI matrix runs across eight Node versions on two operating systems

Per .github/workflows/ci.yml, the test suite runs on Node 18, 19, 20, 21, 22, 23, 24, and 25 — on both Ubuntu and Windows. That's 16 jobs per push.

Trust-proxy has its own mini language

The 'trust proxy' setting accepts a boolean, a number (hop count), a comma-separated string, an array of CIDRs, or a function. compileTrust in lib/utils.js turns each shape into a unified (addr, hop) => boolean. The trustProxyDefaultSymbol is even used to flag whether a parent app's trust proxy should override a child's after mount.

The router was extracted, then mostly forgotten

Express's Router is an external package now (router on npm, pillarjs/router on GitHub). The Express repo simply re-exports it: exports.Router = Router; exports.Route = Router.Route;. The 5.0 release deliberately matched its versioning (and breaking changes) with the new router behaviour, which was the longest-pending change in Express's history.

The History.md file is older than most Node.js apps

Almost 4,000 lines, going back to 2010. It's hand-curated rather than generated, which is why it occasionally stops mid-version (e.g., the current # Unreleased Changes header at the top).