Express vs Fastify: middleware chain vs lifecycle hooks

HOW IT FITS TOGETHER

KEY TERMS

Middleware chain (Express)

Every layer receives (req, res, next) and must either end the response or call next(). There is no separate place for auth, parsing or validation: their position in the list is their meaning, which is why moving one app.use line can open a security hole.

Error middleware and Express 5 async errors

Error handlers are identified by arity: exactly four parameters (err, req, res, next), registered after the routes. Express 5 forwards rejected promises and async throws to them; Express 4 did not, which is why express-async-errors and asyncHandler wrappers exist. Errors thrown later in a timer or event emitter callback still escape.

Lifecycle hooks (Fastify)

onRequest → preParsing → preValidation → preHandler → handler → preSerialization → onSend → onResponse, plus onError, onTimeout and onRequestAbort. Use async hooks or the done callback, never both in one hook; to reply early from an async hook, send and return reply.

Plugins and encapsulation

fastify.register(plugin, opts) creates a child context. Decorators, hooks and nested plugins registered inside are visible to that context and its children only. Wrap shared infrastructure (db, auth decorators) in fastify-plugin to expose it to the parent; keep feature routes encapsulated.

Schema-driven validation and serialization

Route schemas for params, querystring, headers and body are compiled once by Ajv (defaults include coerceTypes: 'array', useDefaults and removeAdditional). A response schema is compiled to a fast-json-stringify function, which is faster than JSON.stringify and drops fields the schema does not list, preventing accidental leaks.

Logging with pino

Fastify({ logger: true }) gives structured JSON logs, a per-request child logger at request.log with a reqId, and automatic request/response lines. Express has no logger; pino-http adds the same per-request req.log.

IN YOUR STACK

import express, { type ErrorRequestHandler } from "express";
import { z } from "zod";

const users = new Map([[1, { id: 1, name: "Ada" }]]);
const findUser = async (id: number) => users.get(id) ?? null;
const Params = z.object({ id: z.coerce.number().int().positive() });
const app = express();
app.use(express.json({ limit: "100kb" }));

app.get("/users/:id", async (req, res) => {
  const parsed = Params.safeParse(req.params);
  if (!parsed.success) return void res.status(400).json({ error: "invalid id" });
  const user = await findUser(parsed.data.id); // a rejection reaches onError
  if (user) res.json(user);
  else res.status(404).json({ error: "user not found" });
});

app.use((req, res) => { res.status(404).json({ error: "not found" }); });
const onError: ErrorRequestHandler = (err, req, res, next) => {
  if (res.headersSent) return next(err);
  console.error(err);
  res.status(500).json({ error: "internal error" });
};
app.use(onError);
app.listen(3000);

import Fastify from "fastify";

const users = new Map([[1, { id: 1, name: "Ada", passwordHash: "x" }]]);
const findUser = async (id: number) => users.get(id) ?? null;

const app = Fastify({ logger: true });

app.get<{ Params: { id: number } }>("/users/:id", {
  schema: {
    params: { type: "object", properties: { id: { type: "integer", minimum: 1 } }, required: ["id"] },
    response: { 200: { type: "object", properties: { id: { type: "integer" }, name: { type: "string" } } } },
  },
}, async (req, reply) => {
  const user = await findUser(req.params.id); // "42" already coerced to 42
  if (!user) return reply.code(404).send({ error: "user not found" });
  return user; // passwordHash is not in the schema, so it is never sent
});

app.setNotFoundHandler((req, reply) => reply.code(404).send({ error: "not found" }));
app.setErrorHandler((err, req, reply) => {
  const status = (err as { statusCode?: number }).statusCode ?? 500;
  if (status >= 500) req.log.error({ err }, "request failed");
  reply.code(status).send({ error: status < 500 ? (err as Error).message : "internal error" });
});
await app.listen({ port: 3000, host: "0.0.0.0" });

import { serve } from "@hono/node-server";
import { zValidator } from "@hono/zod-validator";
import { Hono } from "hono";
import { HTTPException } from "hono/http-exception";
import { z } from "zod";

const users = new Map([[1, { id: 1, name: "Ada" }]]);
const findUser = async (id: number) => users.get(id) ?? null;
const app = new Hono();
const idParam = zValidator("param", z.object({ id: z.coerce.number().int().positive() }), (result, c) => {
  if (!result.success) return c.json({ error: "invalid id" }, 400);
});
app.get("/users/:id", idParam, async (c) => {
  const { id } = c.req.valid("param"); // typed as number
  const user = await findUser(id);
  if (!user) throw new HTTPException(404, { message: "user not found" });
  return c.json(user);
});
app.notFound((c) => c.json({ error: "not found" }, 404));
app.onError((err, c) => {
  if (err instanceof HTTPException) return c.json({ error: err.message }, err.status);
  console.error(err);
  return c.json({ error: "internal error" }, 500);
});
serve({ fetch: app.fetch, port: 3000 });

import { Controller, Get, Injectable, Module, NotFoundException, Param, ParseIntPipe } from "@nestjs/common";
import { NestFactory } from "@nestjs/core";

@Injectable()
class UsersService {
  private users = new Map([[1, { id: 1, name: "Ada" }]]);
  async findOne(id: number) { return this.users.get(id) ?? null; }
}
@Controller("users")
class UsersController {
  constructor(private readonly users: UsersService) {}
  @Get(":id")
  async findOne(@Param("id", ParseIntPipe) id: number) { // "abc" -> 400 before this runs
    const user = await this.users.findOne(id);
    if (!user) throw new NotFoundException("user not found"); // -> 404 JSON
    return user;
  }
}

@Module({ controllers: [UsersController], providers: [UsersService] })
class AppModule {}

const app = await NestFactory.create(AppModule); // pass new FastifyAdapter() to switch
app.enableShutdownHooks();
await app.listen(3000);

import express from "express";

class HttpError extends Error {
  constructor(status, message) { super(message); this.status = status; this.expose = status < 500; }
}
async function createOrder({ sku, qty = 1 }) {
  if (!Number.isInteger(qty) || qty < 1) throw new HttpError(422, "qty must be a positive integer");
  return { id: crypto.randomUUID(), sku, qty }; // persist here; a rejection is handled too
}
const app = express();
app.use(express.json()); // malformed JSON -> error with status 400, expose true

app.post("/orders", async (req, res) => {
  if (!req.body?.sku) throw new HttpError(400, "sku is required"); // no try/catch
  res.status(201).json(await createOrder(req.body));
});
app.use((req, res) => res.status(404).json({ error: "not found" }));
app.use((err, req, res, next) => { // four params, even if next looks unused
  if (res.headersSent) return next(err); // mid-stream: let Express abort the socket
  const status = err.status ?? err.statusCode ?? 500;
  if (status >= 500) console.error(err);
  res.status(status).json({ error: err.expose ? err.message : "internal error" });
});
app.listen(3000);

import Fastify from "fastify";
import fp from "fastify-plugin";

// Shared infrastructure: fp() skips encapsulation so siblings see app.db.
const dbPlugin = fp(async (app, opts) => {
  const db = { query: async (sql) => [{ sql, url: opts.url }] }; // stand-in for a real pool
  app.decorate("db", db);
  app.addHook("onClose", async () => { /* await pool.end() */ });
}, { name: "db" });
// Feature plugin: its hook and decorator stay inside this scope.
async function adminRoutes(app) {
  app.decorateRequest("isAdmin", false);
  app.addHook("onRequest", async (req, reply) => {
    if (req.headers["x-admin-token"] !== process.env.ADMIN_TOKEN) {
      return reply.code(401).send({ error: "unauthorized" });
    }
    req.isAdmin = true;
  });
  app.get("/stats", async () => ({ rows: await app.db.query("select 1") }));
}
const app = Fastify({ logger: true });
await app.register(dbPlugin, { url: process.env.DATABASE_URL });
await app.register(adminRoutes, { prefix: "/admin" });
app.get("/health", async () => ({ ok: true, hasDb: Boolean(app.db) })); // no admin hook
await app.listen({ port: 3000 });

WHEN TO REACH FOR WHAT

WHERE IT BITES

• Registering Express middleware in the wrong order: express.json() after the routes means req.body is undefined, and an auth middleware registered after a router never protects it.
• Using a three-argument error handler in Express, or registering it before the routes. It is then plain middleware and never sees errors.
• Calling done() inside an async Fastify hook, or replying from an async hook without returning reply, which leads to double invocation or FST_ERR_REP_ALREADY_SENT.
• Forgetting fastify-plugin on a plugin that decorates the instance, then wondering why app.db is undefined in sibling routes; or wrapping everything in fp() and losing encapsulation for scoped auth hooks.
• Treating framework benchmarks as capacity planning. Hello-world req/s numbers measure framework overhead; your database, serialization size and logging usually dominate.
• Sending ORM objects straight to res.json() in Express. Without a response schema or DTO mapping, new columns such as password hashes ship to clients automatically.

WHEN IT BREAKS IN PRODUCTION

• CORS fails only in production or on preflight

SOURCES

• Express: Error handling (opens in new tab)Checked 2026-10-11
• Express: Migrating to Express 5 (opens in new tab)Checked 2026-10-11
• Fastify: Lifecycle (opens in new tab)Checked 2026-10-11
• Fastify: Encapsulation (opens in new tab)Checked 2026-10-11
• Fastify: Validation and Serialization (opens in new tab)Checked 2026-10-11
• Fastify: Benchmarks (opens in new tab)Checked 2026-10-11