Koa is a minimal Node.js framework from the team behind Express, and it is still maintained. npm lists koa 3.3.0 from November 3, 2026. Version 3.0.0 landed on April 28, 2025, adding app.currentContext through AsyncLocalStorage and a response.back() redirect helper, and Koa needs Node 18 or newer. The Koa homepage is blunt about its design: it does not bundle any middleware within its core.
That design is also the usual reason people look elsewhere. A real Koa app needs a router, a body parser, CORS, validation and error formatting, each from a separate package. The alternatives below either ship more in the box, run on more runtimes, or keep Koa's style with better types. For a config-first take on the same problem, our hapi alternatives page compares many of the same frameworks from the hapi side.
Picks are ordered by how little of a Koa mental model you have to unlearn.
Prices below are as of November 8, 2026. Our method is on How we review tools.
Quick comparison
| Tool | Best for | Price | Platforms |
|---|---|---|---|
| Hono | Koa-style middleware on any runtime | Free (MIT) | Node, Bun, Deno, Workers, Lambda |
| Express | The largest middleware pool | Free (MIT) | Node.js 18+ |
| Fastify | Speed with schema validation | Free (MIT) | Node.js 20, 22 |
| h3 | Tiny, portable HTTP core | Free (MIT) | Node 20.19+, Bun, Deno, Workers |
| Elysia | Typed APIs on Bun | Free (MIT) | Bun; Node via adapter |
| hapi | Built-in validation and auth | Free (BSD-3-Clause) | Node.js 14.15+ |
| NestJS | Structured TypeScript backends | Free (MIT) | Node.js 20+ |
Hono
Koa developers feel at home in Hono within minutes. Its middleware wraps the handler like layers of an onion: code before await next() runs on the way in, code after it runs on the way out, which is exactly how Koa timing and error middleware work. Context lives on a single c object, much like Koa's ctx.
The difference is where it runs. Hono is built on Web Standards with zero dependencies, so the same app deploys to Cloudflare Workers, Deno, Bun, AWS Lambda or Node. The current release is 4.13.17 from November 7, 2026, MIT-licensed, with 5.0.0-rc.1 on the next tag.
Best for: Koa users who want the same middleware model plus edge and serverless targets.
Pricing:
- Free, MIT licence
- Hosting costs depend on the runtime you deploy to
Watch out for:
- Handlers return a Response instead of assigning ctx.body, as the Hono middleware docs describe, so every Koa route needs a small rewrite.
- A 5.0 release candidate is already out, so a fresh 4.x codebase faces a major upgrade within months.
Official site: Hono.
Express
Express is the older sibling Koa was written to improve on, and version 5 closed much of the gap. Rejected promises from async handlers now go straight to the error middleware, so the .catch(next) boilerplate that pushed people to Koa is gone. Express 5.3.0 was published on October 9, 2026 and needs Node 18 or newer.
What you gain is reach: nearly every Node library ships Express middleware first. The 4.x line also stays supported, at 4.22.3 from September 14, 2026.
Best for: Teams that care more about ecosystem and hiring than about middleware elegance.
Pricing:
- Free, MIT licence
- Extended support for old lines through HeroDevs, price on request
Watch out for:
- Express middleware passes control forward with next() and does not resume afterwards the way Koa's await next() does, so response-time and error-wrapping middleware need a different pattern.
- Version 5 changed route syntax. The Express 5 migration guide requires named wildcards such as /*splat and drops regexp characters in paths.
Official site: Express.
Fastify
Fastify answers the main complaint about Koa: that validation and serialization are left to you. Each route can declare a JSON Schema for its input and output, Fastify validates requests against it, and responses are serialized from it. Logging through Pino is built in, and plugins are encapsulated so one module's decorators do not leak into another.
Its benchmark chart puts Fastify 5.12.7 at 89,733 requests per second against Koa 3.2.1 at 72,594. The current release is 5.12.8 from November 2, 2026, MIT-licensed, and 6.0.0-alpha.6 is on the next tag.
Best for: JSON APIs where schema-checked input and fast output matter.
Pricing:
- Free, MIT licence
- Commercial support for end-of-life versions via HeroDevs, price on request
Watch out for:
- Fastify's request lifecycle uses named hooks such as onRequest and preHandler instead of one middleware stack, which takes some relearning.
- Old majors lose support fast: the Fastify LTS page shows v4 support ending on June 30, 2025, and v6 is already in alpha.
Official site: Fastify.
h3
h3 describes itself as a minimal HTTP framework built for performance and portability, and it shares Koa's taste for a lean core. It is based on Web Standards, works on Node, Bun, Deno and Workers, and the 2.0.8 package depends on just two libraries, rou3 for routing and srvx for the server layer.
Version 2 took a long road. Release candidates started on October 7, 2025, the first stable release of h3 v2 (2.0.1) came out on October 3, 2026, and 2.0.8 followed on October 22, 2026. The 1.x line stays on its own npm tag at 1.15.11.
Best for: Portable APIs and server routes where you want as few dependencies as possible.
Pricing:
- Free, MIT licence
- No paid tier
Watch out for:
- The stable 2.x line is only weeks old, so examples and third-party guides still mostly cover 1.x.
- It needs Node 20.19 or newer, per the engines field on the h3 npm entry, which is a higher floor than Koa's Node 18.
Official site: h3.
Elysia
Elysia is for Koa users who are moving to Bun anyway. It infers types from route definitions, generates OpenAPI docs from the same types, and its Eden client lets a front end call the API with full type checking and no code generation. Validation accepts Zod, Valibot, ArkType or Joi through Standard Schema.
The stable release is 1.4.31 from November 5, 2026, MIT-licensed, published the same day as 2.0.0-rc.3.
Best for: New TypeScript services on Bun with a typed front-end client.
Pricing:
- Free, MIT licence
- No paid tier
Watch out for:
- On Node it runs through the separate @elysiajs/node adapter, whose latest release on npm is 1.4.5 from February 17, 2026.
- With 2.0 at release candidate stage, the 1.x API will change soon.
Official site: Elysia.
hapi
hapi is the opposite of Koa in philosophy. Routes are configuration objects that carry their own validation, auth strategy, caching and payload limits, so the framework enforces what a Koa team would assemble by hand. Every dependency is an @hapi package, which keeps the supply chain short.
According to the @hapi/hapi npm entry, 21.4.13 was published on November 4, 2026 under BSD-3-Clause, and it accepts Node 14.15 or newer.
Best for: Security-sensitive APIs where built-in defaults beat hand-picked middleware.
Pricing:
- Free, BSD-3-Clause licence
- No paid tier
Watch out for:
- Koa middleware does not carry over. hapi extends the request lifecycle through plugins and extension points rather than middleware functions, so each Koa package needs a hapi equivalent or a rewrite.
Official site: hapi.
NestJS
NestJS fits when a Koa service has grown into many services and the team wants rules. Modules, controllers and injectable providers give every feature the same shape, and the HTTP layer underneath is Express by default or Fastify through @nestjs/platform-fastify.
@nestjs/core 12.4.0 was published on November 6, 2026, MIT-licensed, and needs Node 20 or newer. The 11.x line sits on a legacy tag at 11.2.8.
Best for: Larger TypeScript teams that want enforced structure and dependency injection.
Pricing:
- Free, MIT licence
- Enterprise support from the core team, price on request
Watch out for:
- It is heavy for small services. Decorators, modules and providers add ceremony that a 200-line Koa app never needed.
- Paid support is sold with no public price, and the NestJS docs only link to an enterprise support contact.
Official site: NestJS.
How to choose
| If you need | Pick |
|---|---|
| Keep Koa's onion middleware and add edge runtimes | Hono |
| The most middleware and the most developers | Express |
| Schema-validated JSON APIs at high speed | Fastify |
| A tiny core with two dependencies | h3 |
| End-to-end types on Bun | Elysia |
| Validation, auth and limits built in | hapi |
| Strict structure for a big TypeScript team | NestJS |
When to stay with Koa
Stay on Koa if your middleware stack is settled and your team likes composing it. Koa 3 is a small, stable core with recent releases, its official router @koa/router reached 15.7.1 on November 1, 2026, and benchmarks put it ahead of Express. Moving frameworks to gain features you can add with one package rarely pays off.
Frequently asked questions
Is Koa still maintained?
Yes. koa 3.3.0 was published on November 3, 2026, after 3.2.0 in March and 3.2.1 in May 2026. Koa 2 still receives fixes on the latest-2 tag, with 2.16.4 released on February 25, 2026.
Koa vs Express, what is the difference?
Both come from the same team. Express bundles routing and passes control forward through next(). Koa ships no middleware at all, and each layer can run code both before and after the rest of the stack through await next(). Express 5 now handles rejected promises, which removes Koa's old async advantage for error handling.
Which router should I use with Koa?
Use @koa/router, now at 15.7.1 and requiring Node 20 or newer. The older koa-router package on npm carries a deprecation notice that points users to @koa/router from version 9 onward.
Is Koa faster than Express?
On the illustrative benchmark published by Fastify, Koa 3.2.1 serves 72,594 requests per second and Express 5.3.0 serves 67,794. Fastify itself reaches 89,733 and Hono 84,930 on the same chart. The test route does almost nothing, so real apps rarely see the full gap.
