
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
ultimate-express
Advanced tools
The Ultimate Express. Fastest http server with full Express compatibility, based on uWebSockets.
The Ultimate Express. Fastest http server with full Express compatibility, based on µWebSockets.
This library is a very fast re-implementation of Express.js 4.
It is designed to be a drop-in replacement for Express.js, with the same API and functionality, while being much faster. It is not a fork of Express.js.
To make sure µExpress matches behavior of Express in all cases, we run all tests with Express first, and then with µExpress and compare results to make sure they match.
npm install ultimate-express -> replace express with ultimate-express -> done*
Use
npm install ultimate-express@node-v18to install last version that supported Node.js v18.
Similar projects based on uWebSockets:
express on Bun - since Bun uses uWS for its HTTP module, Express is about 2-3 times faster than on Node.js, but still almost 2 times slower than µExpress because it doesn't do uWS-specific optimizations.hyper-express - while having a similar API to Express, it's very far from being a drop-in replacement, and implements most of the functionality differently. This creates a lot of random quirks and issues, making the switch quite difficult. Built in middlewares are also very different, middlewares for Express are mostly not supported.uwebsockets-express - this library is closer to being a drop-in replacement, but misses a lot of APIs, depends on Express by calling it's methods under the hood and doesn't try to optimize routing by using native uWS router.Tested using wrk (-d 60 -t 1 -c 200). Tested on Ubuntu 22.04, Node.js 20.17.0, AMD Ryzen 5 3600, 64GB RAM.
| Test | Express req/sec | µExpress req/sec | Express throughput | µExpress throughput | µExpress speedup |
|---|---|---|---|---|---|
| routing/simple-routes (/) | 11.16k | 75.14k | 2.08 MB/sec | 14.46 MB/sec | 6.73X |
| routing/lot-of-routes (/999) | 4.63k | 54.57k | 0.84 MB/sec | 10.03 MB/sec | 11.78X |
| routing/some-middlewares (/90) | 10.12k | 61.92k | 1.79 MB/sec | 11.32 MB/sec | 6.12X |
| routers/nested-routers (/abccc/nested/ddd) | 10.18k | 51.15k | 1.82 MB/sec | 9.40 MB/sec | 5.02X |
| middlewares/express-static (/static/index.js) | 6.58k | 32.45k | 10.15 MB/sec | 49.43 MB/sec | 4.87X |
| engines/ejs (/test) | 5.50k | 40.82k | 2.45 MB/sec | 18.38 MB/sec | 7.42X |
| middlewares/body-urlencoded (/abc) | 8.07k | 50.52k | 1.68 MB/sec | 10.78 MB/sec | 6.26X |
| middlewares/compression-file (/small-file) | 4.81k | 14.92k | 386 MB/sec | 1.17 GB/sec | 3.10X |
Tested using bun-http-framework-benchmark. This table only includes Node.js results. For full table with other runtimes, check here.
| Framework | Average | Ping | Query | Body |
|---|---|---|---|---|
| uws | 95,531.277 | 109,960.35 | 105,601.47 | 71,032.01 |
| ultimate-express (declarative) | 86,794.997 | 108,546.44 | 105,869.75 | 45,968.8 |
| hyper-express | 68,959.92 | 82,547.21 | 71,685.51 | 52,647.04 |
| ultimate-express | 60,839.75 | 68,938.53 | 66,173.86 | 47,406.86 |
| h3 | 35,423.263 | 41,243.68 | 34,429.26 | 30,596.85 |
| fastify | 33,094.62 | 40,147.67 | 40,076.35 | 19,059.84 |
| hono | 26,576.02 | 36,215.35 | 34,656.12 | 8,856.59 |
| koa | 24,045.08 | 28,202.12 | 24,590.84 | 19,342.28 |
| express | 10,411.313 | 11,245.57 | 10,598.74 | 9,389.63 |
Other benchmarks:
Also tested on a real-world application with templates, static files and dynamic pages with data from database, and showed 1.5-4X speedup in requests per second depending on the page.
In a lot of cases, you can just replace require("express") with require("ultimate-express") and everything works the same. But there are some differences:
case sensitive routing is enabled by default.catch async errors is added. If it's enabled, you don't need to use express-async-errors module.body methods to array with uppercased methods.const https = require("https");
const express = require("express");
const app = express();
https.createServer({
key: fs.readFileSync('path/to/key.pem'),
cert: fs.readFileSync('path/to/cert.pem')
}, app).listen(3000, () => {
console.log('Server is running on port 3000');
});
You have to pass uwsOptions to the express() constructor:
const express = require("ultimate-express");
const app = express({
uwsOptions: {
// https://unetworking.github.io/uWebSockets.js/generated/interfaces/AppOptions.html
key_file_name: 'path/to/key.pem',
cert_file_name: 'path/to/cert.pem'
}
});
app.listen(3000, () => {
console.log('Server is running on port 3000');
});
app.listen() instead.UWS_HTTP_MAX_HEADERS_SIZE to max byte count you need.case sensitive routing is enabled (it is by default, unlike in normal Express).Optimized routes can be up to 10 times faster than normal routes, as they're using native uWS router and have pre-calculated path.
Do not use external serve-static module. Instead use built-in express.static() middleware, which is optimized for uExpress.
Do not use body-parser module. Instead use built-in express.text(), express.json() etc.
Do not set body methods to read body of requests with GET method or other methods that don't need a body. Reading body makes endpoint about 15% slower.
By default, µExpress creates 1 (or 0 if your CPU has only 1 core) child thread to improve performance of reading files. You can change this number by setting threads to a different number in express(), or set to 0 to disable thread pool (express({ threads: 0 })). Threads are shared between all express() instances, with largest threads number being used. Using more threads will not necessarily improve performance. Sometimes not using threads at all is faster, please test both options.
Since you don't create http server manually, you can't properly use http.on("upgrade") to handle WebSockets. To solve this, there's currently 2 options:
ws compatible API: Ultimate WS. It's same concept as this library, but for WebSockets: fast drop-in replacement for ws module with support for Ultimate Express upgrades. There's a guide for how to upgrade http requests in the documentation.app.uwsApp to access uWebSockets.js App instance and call its ws() method directly.HTTP/3 is supported. To use:
const app = express({
http3: true,
uwsOptions: {
key_file_name: '/path/to/example.key',
cert_file_name: '/path/to/example.crt'
}
});
In general, basically all features and options are supported. Use Express 4.x documentation for API reference.
✅ - Full support (all features and options are supported)
🚧 - Partial support (some options are not supported)
❌ - Not supported
end(), encrypted, remoteAddress and localPort are supported)Almost all middlewares that are compatible with Express are compatible with µExpress. Here's list of middlewares that we test for compatibility:
express.text() etc instead for better performance)express.static() instead for better performance)Middlewares and modules that are confirmed to not work:
app.set('catch async errors', true) instead.Any Express view engine should work. Here's list of engines we include in our test suite:
FAQs
The Ultimate Express. Fastest http server with full Express compatibility, based on uWebSockets.
We found that ultimate-express demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.