cors
npmv2.8.6Node.js CORS middleware
Safe to adopt
Yes — cors scores well across adoption, maintenance, weight, supply chain, and licensing. 69.7M downloads per week and 6 known dependents. Last published 230 days ago.
- AAdoption: grade A, Excellent.
69.7M downloads per week and 6 known dependents.
- BMaintenance: grade B, Good.
Last published 230 days ago.
- AWeight: grade A, Excellent.
Pulls in 2 transitive packages, about 19 KB installed (at least — some of the tree is still being crawled).
- ASupply chain: grade A, Excellent.
No install scripts, 3 maintainers, and a contained dependency surface.
- ALicense: grade A, Excellent.
MIT — permissive, with no copyleft found in the dependency tree.
Grades are computed deterministically from registry metadata collected by PackageGraph — downloads, dependents, publish dates, the resolved dependency tree, maintainer count, and declared licenses. No third-party scores are used.
Install cost
What you actually take on by adding cors to a project.
Runtime packages this one declares itself.
Distinct packages in the full runtime tree, deduplicated the way a package manager would.
Unpacked size of this package plus its entire runtime tree.
Longest resolved dependency chain below this package.
Part of this dependency tree has not been crawled yet, so these figures are a lower bound rather than a final total.
Licenses in the dependency tree
Every license you inherit by installing cors, not just its own. Check this before a legal review, not after.
Compatibility
- Node.js
- node >= 0.10
- Module format
- CommonJS only
- TypeScript
- No bundled types
- Install scripts
- None
Quick start
A usage example from the cors README.
var express = require('express')
var cors = require('cors')
var app = express()
// Adds headers: Access-Control-Allow-Origin: *
app.use(cors())
app.get('/products/:id', function (req, res, next) {
res.json({msg: 'Hello'})
})
app.listen(80, function () {
console.log('web server listening on port 80')
})cors vs the alternatives
Packages solving a similar problem in the npm ecosystem, compared on the signals that drive an adoption decision.
| Package | Weekly downloads | Dependents | License | Last release |
|---|---|---|---|---|
| corsthis page | 69.7M | 6 | MIT | 7 months ago |
| express-rate-limit | 0 | 2 | MIT | 1 day ago |
| nocache | 0 | 1 | MIT | 1 day ago |
| connect | 0 | 7 | MIT | 1 day ago |
| express | 92.8M | 17 | MIT | 1 day ago |
| get-port | 17M | 1 | MIT | 1 day ago |
Dependencies
Declared by cors v2.8.6. Runtime dependencies are installed with the package; dev dependencies are not.
Runtime (2)
Dev (6)
Used by
Popular packages that depend on cors.
Native-ESM powered web dev build tool
Low-level network interception library for Node.js.
node.js realtime framework server
The realtime engine behind Socket.IO. Provides the foundation of a bidirectional connection between client and server
Model Context Protocol implementation for TypeScript
A simple common HTTP client specifically for Google APIs and services.
Relationship graph
Dependencies (left) and dependents (right) of cors.
Frequently installed together
TypeScript definitions for node
TypeScript definitions for cors
An extremely fast JavaScript and CSS bundler and minifier.
Node.js library that communicates with Embedded Dart Sass using the Embedded Sass protocol
A pure JavaScript implementation of Sass.
Vite DevTools
Fast, unopinionated, minimalist web framework
TypeScript Execute (tsx): Node.js enhanced with esbuild to run TypeScript & ESM files
Cross platform child_process#spawn and child_process#spawnSync
A light-weight module that brings Fetch API to node.js
Packs ECMAScript/CommonJs/AMD modules for the browser. Allows you to split your codebase into multiple bundles, which can be loaded on demand. Supports loaders to preprocess files, i.e. json, jsx, es7, css, less, ... and your custom stuff.
TypeScript definitions for ws
Release history
1 release in the last two years, typically about 31 days apart.
| Version | Published | Size | License |
|---|---|---|---|
| 2.8.6latest | 7 months ago | 19 KB | MIT |
| 2.8.5 | 7 years ago | 20 KB | MIT |
| 2.8.4 | 9 years ago | — | MIT |
| 2.8.3 | 9 years ago | — | MIT |
| 2.8.2 | 9 years ago | — | MIT |
| 2.8.1 | 10 years ago | — | MIT |
| 2.8.0 | 10 years ago | — | MIT |
| 2.7.2 | 10 years ago | — | MIT |
| 2.7.1 | 11 years ago | — | MIT |
| 2.7.0 | 11 years ago | — | MIT |
| 2.6.1 | 11 years ago | — | MIT |
| 2.6.0 | 11 years ago | — | MIT |
| 2.5.3 | 11 years ago | — | MIT |
| 2.5.2 | 12 years ago | — | MIT |
| 2.5.1 | 12 years ago | — | MIT |
Overview
cors is an npm package that node.js CORS middleware. It is extremely widely used, with about 69.7M downloads per week and 6 known dependents in the graph. The latest version is 2.8.6, released under the MIT license.
Who should use it
Teams working in the npm ecosystem who need node.js CORS middleware and value a battle-tested, widely-adopted solution.
When not to use it
Consider an alternative if you need to have first-class TypeScript types out of the box, or if a more actively-maintained option better fits your npm stack.
Pros
- Large, well-established user base (69.7M weekly downloads).
- Clear open-source license (MIT).
Cons
- No bundled TypeScript types (may require a separate @types package).
Auto-generated from collected registry metadata. No external claims are inferred.
Maintainers
Keywords
Funding
Frequently asked questions
Should I use cors?
Yes — cors scores well across adoption, maintenance, weight, supply chain, and licensing. 69.7M downloads per week and 6 known dependents. Last published 230 days ago.
How do I install cors?
Run `npm install cors` to add cors to your npm project.
How many dependencies does cors have?
cors declares 8 direct dependencies and pulls in 2 packages in total once its runtime tree is resolved totalling about 19 KB on disk.
What license is cors released under?
cors is distributed under the MIT license.
How popular is cors?
cors has approximately 69,729,609 downloads per week and 6 known dependent packages.
Is cors still maintained?
The most recent release of cors (v2.8.6) was published 7 months ago.
Does cors run install scripts?
No. cors does not define preinstall, install, or postinstall scripts, so installing it does not execute publisher-supplied code.