Gathering detailed insights and metrics for koa
Gathering detailed insights and metrics for koa
Gathering detailed insights and metrics for koa
Gathering detailed insights and metrics for koa
Expressive middleware for node.js using ES2017 async functions
npm install koa
Typescript
Module System
Min. Node Version
Node Version
NPM Version
96.3
Supply Chain
98.3
Quality
86.6
Maintenance
100
Vulnerability
100
License
JavaScript (100%)
Total Downloads
427,292,371
Last Day
176,815
Last Week
3,855,977
Last Month
16,499,274
Last Year
140,938,153
MIT License
35,546 Stars
1,261 Commits
3,224 Forks
821 Watchers
8 Branches
249 Contributors
Updated on Jul 01, 2025
Minified
Minified + Gzipped
Latest Version
3.0.0
Package Id
koa@3.0.0
Unpacked Size
62.13 kB
Size
16.13 kB
File Count
11
NPM Version
10.9.2
Node Version
22.15.0
Published on
Apr 28, 2025
Cumulative downloads
Total Downloads
Last Day
6.3%
176,815
Compared to previous day
Last Week
-6%
3,855,977
Compared to previous week
Last Month
9.6%
16,499,274
Compared to previous month
Last Year
78.9%
140,938,153
Compared to previous year
Expressive HTTP middleware framework for node.js to make web applications and APIs more enjoyable to write. Koa's middleware stack flows in a stack-like manner, allowing you to perform actions downstream then filter and manipulate the response upstream.
Only methods that are common to nearly all HTTP servers are integrated directly into Koa's small ~570 SLOC codebase. This includes things like content negotiation, normalization of node inconsistencies, redirection, and a few others.
Koa is not bundled with any middleware.
Koa requires node v18.0.0 or higher for ES2015 and async function support.
$ npm install koa
1const Koa = require('koa'); 2const app = new Koa(); 3 4// response 5app.use(ctx => { 6 ctx.body = 'Hello Koa'; 7}); 8 9app.listen(3000);
Koa is a middleware framework that can take two different kinds of functions as middleware:
Here is an example of logger middleware with each of the different functions:
1app.use(async (ctx, next) => { 2 const start = Date.now(); 3 await next(); 4 const ms = Date.now() - start; 5 console.log(`${ctx.method} ${ctx.url} - ${ms}ms`); 6});
1// Middleware normally takes two parameters (ctx, next), ctx is the context for one request, 2// next is a function that is invoked to execute the downstream middleware. It returns a Promise with a then function for running code after completion. 3 4app.use((ctx, next) => { 5 const start = Date.now(); 6 return next().then(() => { 7 const ms = Date.now() - start; 8 console.log(`${ctx.method} ${ctx.url} - ${ms}ms`); 9 }); 10});
The middleware signature changed between v1.x and v2.x. The older signature is deprecated.
Old signature middleware support will be removed in v3
Please see the Migration Guide for more information on upgrading from v1.x and using v1.x middleware with v2.x.
Each middleware receives a Koa Context
object that encapsulates an incoming
http message and the corresponding response to that message. ctx
is often used
as the parameter name for the context object.
1app.use(async (ctx, next) => { await next(); });
Koa provides a Request
object as the request
property of the Context
.
Koa's Request
object provides helpful methods for working with
http requests which delegate to an IncomingMessage
from the node http
module.
Here is an example of checking that a requesting client supports xml.
1app.use(async (ctx, next) => { 2 ctx.assert(ctx.request.accepts('xml'), 406); 3 // equivalent to: 4 // if (!ctx.request.accepts('xml')) ctx.throw(406); 5 await next(); 6});
Koa provides a Response
object as the response
property of the Context
.
Koa's Response
object provides helpful methods for working with
http responses which delegate to a ServerResponse
.
Koa's pattern of delegating to Node's request and response objects rather than extending them
provides a cleaner interface and reduces conflicts between different middleware and with Node
itself as well as providing better support for stream handling. The IncomingMessage
can still be
directly accessed as the req
property on the Context
and ServerResponse
can be directly
accessed as the res
property on the Context
.
Here is an example using Koa's Response
object to stream a file as the response body.
1app.use(async (ctx, next) => { 2 await next(); 3 ctx.response.type = 'xml'; 4 ctx.response.body = fs.createReadStream('really_large.xml'); 5});
The Context
object also provides shortcuts for methods on its request
and response
. In the prior
examples, ctx.type
can be used instead of ctx.response.type
and ctx.accepts
can be used
instead of ctx.request.accepts
.
For more information on Request
, Response
and Context
, see the Request API Reference,
Response API Reference and Context API Reference.
The object created when executing new Koa()
is known as the Koa application object.
The application object is Koa's interface with node's http server and handles the registration of middleware, dispatching to the middleware from http, default error handling, as well as configuration of the context, request and response objects.
Learn more about the application object in the Application API Reference.
Check the Troubleshooting Guide or Debugging Koa in the general Koa guide.
$ npm test
To report a security vulnerability, please do not open an issue, as this notifies attackers of the vulnerability. Instead, please email dead_horse, jonathanong, and niftylettuce to disclose.
See AUTHORS.
Looking for a career upgrade?
Support us with a monthly donation and help us continue our activities.
Become a sponsor and get your logo on our README on Github with a link to your site.
0/10
Summary
Inefficient Regular Expression Complexity in koa
Affected Versions
< 0.21.2
Patched Versions
0.21.2
0/10
Summary
Inefficient Regular Expression Complexity in koa
Affected Versions
>= 1.0.0, < 1.7.1
Patched Versions
1.7.1
0/10
Summary
Inefficient Regular Expression Complexity in koa
Affected Versions
>= 3.0.0-alpha.0, < 3.0.0-alpha.3
Patched Versions
3.0.0-alpha.3
0/10
Summary
Inefficient Regular Expression Complexity in koa
Affected Versions
>= 2.0.0, < 2.15.4
Patched Versions
2.15.4
5/10
Summary
Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function
Affected Versions
>= 3.0.0-alpha.1, < 3.0.0-alpha.5
Patched Versions
3.0.0-alpha.5
5/10
Summary
Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function
Affected Versions
< 2.16.1
Patched Versions
2.16.1
Reason
21 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
Reason
security policy file detected
Details
Reason
1 existing vulnerabilities detected
Details
Reason
dependency not pinned by hash detected -- score normalized to 4
Details
Reason
Found 7/24 approved changesets -- score normalized to 2
Reason
detected GitHub workflow tokens with excessive permissions
Details
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
Score
Last Scanned on 2025-06-23
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More