Node.js frameworks compared: Next.js, Express, Astro and more

The Node.js ecosystem has hundreds of frameworks, but in 2026 roughly 40 see serious use, and about a dozen account for most production work. They fall into five groups: full-stack meta-frameworks (Next.js, Astro, Nuxt, SvelteKit), UI libraries (React, Vue, Angular, Svelte), backend frameworks (Express, Fastify, NestJS, Hono), desktop and mobile frameworks (Electron, React Native), and static site generators. Picking one is less about raw speed and more about what you are building, who maintains the project, and how quickly it ships security fixes.

This guide covers each major framework: why it was built, who built it, who maintains it now, where it is used in industry, where it is a poor fit, and how it holds up on maintenance and security. It ends with benchmark numbers, comparison tables and a decision guide.

What counts as a Node.js framework?

Node.js is a JavaScript runtime: the program that runs JavaScript outside a browser, on servers and developer machines. A framework is a library that gives your code a structure and calls into it, rather than you calling into it. Strictly, only backend frameworks like Express or Fastify run on Node.js in production. The others use Node.js for their tooling (dev server, bundler, build step) and often for server rendering.

That is why React belongs on this list with an asterisk. React is a UI library that runs in the browser. It needs Node.js to build and, through frameworks like Next.js, to render on the server, but it is not a server framework itself.

The five groups:

Two terms come up repeatedly. Server-side rendering (SSR) means generating the page's HTML on the server for each request. Hydration is the step where JavaScript in the browser attaches to that HTML and makes it interactive. Much of the difference between modern frameworks comes down to how much hydration they do and when.

Which Node.js frameworks are used most in 2026?

Two large surveys give a reasonable picture. The Stack Overflow Developer Survey 2026 (published October 2026) asks all developers which web frameworks they use. The State of JavaScript 2025 survey (published early 2026) asks JavaScript developers specifically, so its percentages run higher.

Weekly npm downloads tell a different story, because they count CI runs, transitive installs and bots, not people. Treat them as a measure of how deeply a package is embedded in the ecosystem, not how popular it is with developers. Figures below are for the week ending 12 November 2026.

Hono's number is the clearest example of the gap. It is far behind Express in surveys but has over half of Express's downloads, because many other packages depend on it. Nearly everything here is MIT-licensed, so licensing is rarely the deciding factor.

Full-stack meta-frameworks

Next.js

• Why it was built: to give React apps server rendering, file-based routing and a production build without hand-wiring webpack and a Node server.
• Who built it: Vercel (then called ZEIT), first released in 2016.
• Who maintains it: Vercel's Next.js team, with outside contributors. The current major is 16.
• Who uses it: the Next.js showcase lists Nike, Sonos, OpenAI, Zapier and NerdWallet, among others.
• Good for: large React applications that mix static pages, server-rendered pages and APIs. E-commerce, SaaS dashboards, marketing sites with logged-in areas, and AI chat front ends.
• Not a good fit for: small content sites where shipping a React runtime is unnecessary, or teams that want a framework with few concepts. The App Router, React Server Components, caching layers and middleware are powerful but take time to learn.

React Server Components (RSC) are React components that run only on the server and send rendered output, not their code, to the browser. Next.js was the first major framework built around them, which is why RSC security issues (covered below) hit Next.js users directly.

Maintainability is good: releases are frequent and well documented, and Next.js now runs a formal monthly security-release process with named LTS lines. The trade-off is pace. Major versions arrive often and sometimes change defaults, such as caching behaviour, so upgrades need reading, not just a version bump. Next.js runs best on Vercel, but it also deploys to Node servers, containers and other hosts through adapters.

Astro

• Why it was built: content-heavy sites were shipping far more JavaScript than they needed. Astro renders pages to HTML and ships zero JavaScript by default.
• Who built it: Fred K. Schott and the team behind Snowpack, first released in 2021.
• Who maintains it: the Astro core team, who joined Cloudflare in January 2026. Astro stays MIT-licensed and deploys to any host. The current major is 7.
• Who uses it: the Astro showcase lists IKEA, Porsche, Unilever, Visa and The Guardian.
• Good for: documentation, blogs, marketing sites, landing pages and e-commerce storefronts where most of the page is content.
• Not a good fit for: highly interactive apps where nearly every part of the screen is stateful, such as editors, design tools or complex dashboards.

Astro's key idea is islands architecture: the page is static HTML, and only the interactive pieces (the "islands") load JavaScript and hydrate. You can write those islands in React, Vue, Svelte, Solid or Preact, which also makes Astro a practical way to migrate between UI libraries. In the State of JS 2025 survey, Astro ranked first for satisfaction among meta-frameworks.

Nuxt

• Why it was built: to bring the Next.js model (server rendering, file routing, conventions) to Vue.
• Who built it: brothers Sébastien and Alexandre Chopin, in 2016.
• Who maintains it: the Nuxt core team. NuxtLabs joined Vercel in July 2025, and Nuxt and its server engine Nitro remain MIT with open governance. The current major is 4; Nuxt 3 reached end of life on 31 July 2026.
• Who uses it: the Nuxt showcase lists Louis Vuitton, Nintendo, NASA JPL and GitLab.
• Good for: Vue teams building anything from marketing sites to full applications. Its auto-imports and modules make common features quick to add.
• Not a good fit for: teams not using Vue.

Nitro, Nuxt's server layer, is worth knowing on its own. It compiles your server code into a small output that runs on Node, Deno, Bun, Cloudflare Workers and serverless platforms.

SvelteKit

• Why it was built: to give Svelte an official app framework with routing, server rendering and adapters for different hosts.
• Who built it: the Svelte team led by Rich Harris, who has worked at Vercel since 2021. SvelteKit 1.0 shipped in December 2022.
• Who maintains it: the Svelte core team. SvelteKit 3 shipped on 1 October 2026; Svelte itself is on version 5.
• Who uses it: Datawrapper documented its migration to SvelteKit. The Svelte homepage lists Apple, Spotify, The New York Times and IKEA as Svelte users.
• Good for: apps where small bundles and fast interaction matter, interactive journalism, dashboards and teams that like writing less boilerplate.
• Not a good fit for: teams that need the largest possible hiring pool or third-party component ecosystem; React's is still much bigger.

React Router (formerly Remix)

• Why it was built: Remix, created by Ryan Florence and Michael Jackson, set out to lean on web fundamentals: HTML forms, HTTP caching and server-side data loading, with less client-side state.
• Who maintains it: the Remix team, backed by Shopify since 2022. Remix merged into React Router v7 in November 2024, and React Router v8 shipped in June 2026. Separately, the team is building Remix 3 as a new framework that is not based on React.
• Who uses it: Shopify, for Hydrogen (its storefront framework) and the Shop app.
• Good for: React apps that are form- and data-heavy, where you want each route to load its own data on the server and progressive enhancement to work.
• Not a good fit for: teams who want a fixed, long-lived API. The project has changed direction more than once, so check which line (React Router or Remix 3) you are adopting.

TanStack Start

• Who built it: Tanner Linsley, author of TanStack Query and TanStack Router. Version 1.0 was declared stable on 13 October 2026.
• Good for: React or Solid teams who want type-safe routing and server functions with fewer conventions than Next.js.
• Not a good fit for: teams who want a long production track record; it is new.

Others worth knowing

• SolidStart (Solid's meta-framework), Qwik City (Qwik's), and Analog (Angular's) serve their respective UI libraries.
• Gatsby, an early React static-site framework, has been in maintenance mode since late 2024 under Netlify: security fixes and simple bug fixes, no roadmap. It is not a good choice for new projects.
• RedwoodJS and Blitz.js are full-stack React frameworks with smaller communities.

UI libraries: React, Vue, Angular and the rest

A few terms in that table. A virtual DOM is an in-memory copy of the page that React compares between renders to work out what changed. Signals are reactive values that update exactly the parts of the page that read them, with no full re-render. Dependency injection (DI) means the framework creates and hands your classes the objects they need, rather than each class creating its own. Resumability means the browser picks up where the server left off without re-running component code, so Qwik can skip most hydration.

The React Foundation, launched on 24 February 2026 under the Linux Foundation, now owns React, React Native and JSX. Its platinum members include Meta, Microsoft, Amazon, Vercel, Expo and Callstack. For long-term planning, this matters: React no longer depends on a single company's priorities.

Angular changed its release cadence starting with v22 (June 2026): one major per year, each supported for 24 months. That suits enterprises that plan upgrades annually.

Backend frameworks: Express, Fastify, NestJS, Hono

Express

• Why it was built: to give Node's low-level http module a simple routing and middleware layer.
• Who built it: TJ Holowaychuk, in 2010.
• Who maintains it: a volunteer technical committee under the OpenJS Foundation, where Express is an Impact project. Express 5 was published in 2024 and is now the default (5.3.0). Express 4 is in maintenance with no fixed end-of-life date yet.
• Who uses it: a huge share of Node backends. PayPal's early Node platform was built on it, and 80.8% of State of JS back-end respondents have used it.
• Good for: small to medium APIs, prototypes, and any project where you want the largest pool of tutorials and middleware.
• Not a good fit for: throughput-critical services. As the benchmark below shows, it is the slowest of the common options.

Express 5 fixed long-standing gaps: rejected promises in async handlers now reach your error handler, and routing moved to a newer path-to-regexp that closes a class of regex denial-of-service bugs.

Fastify

• Why it was built: to show that a Node framework could be fast and still have a plugin system, schema validation and good logging.
• Who built it: Matteo Collina and Tomas Della Vedova, in 2016.
• Who maintains it: the Fastify core team under the OpenJS Foundation (an At-Large project). The current major is 5; 6.0 is in alpha.
• Who uses it: Val Town publicly documented moving from Express to Fastify; Nearform and Platformatic run it in production. NestJS can also use it as its HTTP layer.
• Good for: high-throughput APIs, microservices, and teams that want JSON Schema validation built in.
• Not a good fit for: teams who depend heavily on Express-specific middleware, though a compatibility plugin exists.

Fastify gets much of its speed from compiling your JSON Schemas into fast serializers and validators ahead of time.

import Fastify from 'fastify';

const app = Fastify({ logger: true });

app.get('/users/:id', {
  schema: {
    params: { type: 'object', properties: { id: { type: 'integer' } } },
    response: { 200: { type: 'object', properties: { id: { type: 'integer' }, name: { type: 'string' } } } },
  },
}, async (req) => ({ id: req.params.id, name: 'Ada' }));

await app.listen({ port: 3000 });

NestJS

• Why it was built: to give Node backends the structure of Angular or Spring: modules, controllers, providers and dependency injection, written in TypeScript.
• Who built it: Kamil Myśliwiec, in 2017.
• Who maintains it: the NestJS core team. Version 12 shipped in August 2026 with ESM core packages and a new observability package.
• Who uses it: the NestJS site lists Adidas, BMW, GitLab, IBM, Roche and Decathlon.
• Good for: large backends with many developers, where consistent structure matters more than minimal code. It has first-class support for GraphQL, WebSockets, queues and microservices.
• Not a good fit for: small services or edge functions. It adds startup time and per-request overhead, and its decorators and DI are a lot of concept for a single endpoint.

Hono

• Why it was built: to run the same web framework on any JavaScript runtime that supports the standard Request and Response objects.
• Who built it: Yusuke Wada, in December 2021. He works at Cloudflare.
• Who maintains it: the Hono core team. Version 4 is current; v5 is in release candidate.
• Who uses it: Hono lists Cloudflare (for D1, Workers KV and cdnjs), Clerk, Unkey and PostHog.
• Good for: APIs that need to run on Cloudflare Workers, Deno, Bun and Node from one codebase; edge functions; and small, fast services.
• Not a good fit for: apps that want a full batteries-included structure like NestJS or AdonisJS.

import { Hono } from 'hono';

const app = new Hono();
app.get('/hello/:name', (c) => c.json({ hello: c.req.param('name') }));

export default app; // works as a Cloudflare Worker, Bun or Deno handler

Koa, hapi, AdonisJS and tRPC

• Koa, by the team behind Express (2013), is a smaller, async-first take on Express. Koa 3 shipped in April 2025. Good for teams that want minimalism; its middleware ecosystem is smaller.
• hapi came out of Walmart Labs in 2011, built by Eran Hammer for large retail traffic. Since late 2020 a community steering committee maintains it, and releases continue. It favours configuration over code and has strong built-in validation and auth.
• AdonisJS, by Harminder Virk, is the closest thing Node has to Laravel or Rails: ORM, auth, mail, queues and validation in one package. Version 7 shipped in February 2026 and requires Node 24.
• tRPC is not a full framework but a way to call server functions from a TypeScript client with shared types and no code generation. It fits monorepos where the same team owns both sides.

Desktop and mobile frameworks

Electron ships a new major every eight weeks and supports the latest three, so an Electron app that does not update for six months is on an unsupported version. Its main trade-off is size: every app bundles its own Chromium. Tauri uses the system's web view instead, which makes apps much smaller, but native-side logic is written in Rust and must test on each platform's browser engine.

How fast are Node.js frameworks? Benchmarks

HTTP throughput

The test: each server returns {"hello":"world"} as JSON from a single route. It was run on Node.js 22.23 on a 2 vCPU cloud VM, with autocannon (100 connections, 15 seconds, after a 5-second warm-up) on the same machine. Each number is the average of two runs, and all requests succeeded.

p99 latency is the response time that 99% of requests beat; the slowest 1% take longer. It matters more than the average once you run at scale, as tail latency at p99 explains.

How to read this:

• Fastify and Hono add little overhead on top of raw Node. Express costs about five times more per request in this test.
• NestJS inherits most of its cost from Express here. Switching NestJS to its Fastify adapter typically recovers much of the gap.
• This is a hello-world test. In a real service, a database query of 5 ms dwarfs a framework overhead measured in microseconds. Framework speed matters most for high-volume, low-work endpoints: proxies, gateways, auth checks and caches.
• Your numbers will differ with hardware, Node version and load generator. Run the same test on your own machines before deciding.

For a wider cross-language view, TechEmpower's Framework Benchmarks published Round 23 in March 2025; its repository was archived in March 2026, so treat that round as the last.

Client JavaScript size

The second test measures how much JavaScript the browser downloads for the same small counter app, built with each library's official Vite template (Vite production build, all JS files gzipped at level 9).

React's baseline is the largest by a wide margin: about 68 KB gzipped before you write any app code, roughly nine times Preact. On a fast laptop that is invisible. On a mid-range phone over a slow network, parsing and running that code is a real delay. This is the main reason Astro, Preact and Qwik exist. As apps grow, the gap narrows, because your own code starts to outweigh the runtime.

How maintainable are these frameworks?

Maintainability here means: is there a funded team behind the project, how often do breaking changes arrive, and how long is each version supported?

The healthiest signals are a funded core team, a written support policy, and a security process with advisories. Corporate backing helps with funding, but foundation governance (OpenJS for Express, Fastify and Electron; the Linux Foundation for React) reduces dependence on one company.

Security: bugs, CVEs and supply chain

A CVE (Common Vulnerabilities and Exposures) is a public identifier for a specific security flaw. CVSS is a 0 to 10 severity score attached to it, where 9.0 and above is critical. Every popular framework has a CVE history; what matters is how fast fixes ship and whether you apply them.

Notable vulnerabilities since 2024

Remote code execution (RCE) means an attacker can run their own code on your server, which is the worst class of bug. The December 2025 RSC issue is a useful lesson: it affected any app using React Server Components through any framework, not just Next.js, and patched versions were available on the day it was disclosed.

Supply-chain attacks

Framework code is only part of the risk. In September 2025 a maintainer of chalk, debug and related packages was phished, and malicious versions of packages with about 2.6 billion combined weekly downloads were published before being pulled within roughly an hour. The same month, a self-spreading worm called Shai-Hulud stole npm tokens and published itself into more than 500 packages, with a second wave in November 2025. In May 2026, attackers chained a GitHub Actions misconfiguration to publish 84 malicious versions across 42 @tanstack/* packages for about four and a half hours.

None of these were bugs in a framework's design. They were attacks on how packages are published. The defences are the same for every framework:

# Install exactly what the lockfile says, nothing newer
npm ci

# Check for known vulnerabilities
npm audit --omit=dev

# Skip install scripts for packages that don't need them
npm config set ignore-scripts true

Beyond that: pin versions with a lockfile, enable a delay before adopting brand-new releases where your tooling supports it, use trusted publishing with short-lived tokens if you publish packages, and subscribe to your framework's security advisories.

Security practices by framework type

• Meta-frameworks have the largest attack surface because they run code on both server and client and blur the line between them. Never rely on middleware alone for authorization; check permissions again where the data is read.
• Backend frameworks are smaller, but most risk comes from middleware you add. Validate input with schemas (Fastify does this natively), set body size limits, and add rate limits.
• Electron apps run Node with access to the file system. Keep contextIsolation on, disable nodeIntegration in renderers, and stay within the supported three majors.

Which Node.js framework should you choose?

If you are writing your backend in TypeScript, recent Node versions can run it directly, as covered in running TypeScript natively in Node.js, which removes a build step for small services.

The short version: pick the framework that matches the shape of your app first, then check that it has a funded team, a written support policy and a security advisory process. Speed is the last tiebreaker, not the first.

Key takeaways

• About a dozen frameworks cover most production Node.js work: Next.js, Astro, Nuxt, SvelteKit, React Router, React, Vue, Angular, Express, Fastify, NestJS and Hono.
• React is a UI library, not a Node framework; Next.js, React Router and TanStack Start are the frameworks that run it on the server.
• In a hello-world benchmark, Fastify and Hono ran at about 86% of raw Node speed, while Express and NestJS ran at 14 to 17%.
• React's baseline bundle is about 68 KB gzipped, versus 6 to 13 KB for Solid, Preact, Lit and Svelte.
• Supply-chain attacks hit every framework equally; lockfiles, npm ci, audits and fast patching are the real defence.

FAQ

How many Node.js frameworks are there?

There are hundreds on npm, but around 40 have meaningful adoption and about 12 dominate production use. New ones appear every year, and a few, like Gatsby, fade into maintenance mode.

Is Express still a good choice in 2026?

Yes, for small and medium APIs where speed is not the bottleneck. It has the largest ecosystem and Express 5 fixed its main gaps. For high-throughput services, Fastify or Hono handle several times more requests on the same hardware.

Is Next.js a backend framework?

Partly. It runs server code for rendering, route handlers and server actions, which is enough for many apps. For a large, separate API with background jobs and queues, teams often pair it with a dedicated backend like NestJS or Fastify.