HTTP Framework Benchmark
How does Wooks compare with Express, Fastify, h3 and Hono? This isn't a "hello world" test — it exercises the full HTTP request lifecycle of a realistic API.
Full source code: prostojs/router-benchmark
Why Not "Hello World"?
Most framework benchmarks test a single GET / route returning a string. That tells you little about real-world performance, where every request involves routing, header inspection, cookie parsing, auth checks, body parsing, and response serialization.
This benchmark simulates a project management SaaS API with 22 routes across three authentication tiers.
Frameworks Tested
| Framework | Router |
|---|---|
| Wooks | @prostojs/router |
| Fastify | find-my-way |
| h3 | rou3 |
| Hono | SmartRouter (RegExpRouter / TrieRouter) |
| Express | Express router (baseline) |
Methodology
Load is generated with autocannon (100 connections, pipelining 10) across 20 test scenarios. Each framework runs in its own server process, started fresh for each round.
Every request goes through the full HTTP lifecycle — routing, header inspection, cookie parsing (a realistic ~20-cookie jar), auth checks, body parsing, and response serialization. Before measuring, a pre-flight check verifies that every server returns the same status codes, bodies and headers. Every framework checks auth before parsing the request body, and handlers are synchronous unless they read the body.
Indicative estimate
On a laptop: Apple M4 MacBook Air (fanless), Node.js 24.22, 1 s warmup + 2 s measured per test in a single round; the DB-mode run measured 1 s per test over 3 rounds. Treat differences of a few percent as noise.
Traffic Distribution
Tests are weighted to reflect what a SaaS app typically sees:
| Traffic type | Weight |
|---|---|
| Cookie-auth reads (browser) | 42% |
| Cookie-auth writes (browser) | 18% |
| Header-auth (API clients) | 16% |
| Public / static | 10% |
| Auth failures | 5% |
| 404 responses | 5% |
| Bot / scanner traffic | 4% |
The headline number is the traffic-mix throughput: the weighted harmonic mean of the per-test results, i.e. the req/s of a server receiving this request mix. Unlike an arithmetic average, it gives slow tests their real share of server time.
Overall Throughput
Traffic-mix throughput across all 20 test scenarios:
Fastify has the highest throughput, with Wooks 1.02x behind — a 2% gap, within the noise of a single-round run — followed by Hono (1.22x), h3 (1.38x) and Express (1.97x).
Key insight
The router benchmark shows differences of up to 62x between routers; in the full framework benchmark the fastest-to-slowest ratio is 1.97x. Routing is a small fraction of what an HTTP server does — the rest is TCP, HTTP parsing, headers, cookies, bodies, and serialization. Wooks' router is mid-pack in the router benchmark, yet Wooks is second here.
Public & Static Routes
Static responses, wildcard routing, login with set-cookie.
Fastify is ahead on every test in this group: by 4% over Wooks on the short static route, 12% on the wildcard-with-cache route, 15% on login and 18% on the deep wildcard. Wooks is second on all four, ahead of Hono, h3 and Express.
Header-Auth API Routes
Bearer-token authenticated endpoints — typical API client traffic.
Fastify leads every test in this group. Wooks is second on the GET routes (6–13% behind Fastify) and 18% behind on the small POST, where h3 is slightly ahead of it. On the auth failure (401), Fastify and Hono are ahead of Wooks.
Cookie-Auth Browser Routes
The biggest traffic category in a SaaS app — browser requests with ~20 cookies per request.
Wooks has the highest throughput on the cookie-authenticated GET routes — 6–12% ahead of Fastify and 37–41% ahead of Hono.
Wooks parses cookies lazily: the useCookies() composable doesn't touch the cookie header until you call getCookie().
On the small POST/PUT bodies Fastify is about 6% ahead of Wooks. On the large (~25 KB) JSON body all five are close (12,500–14,200 req/s): Hono and h3 lead, Wooks is third (13,255) ahead of Fastify and Express.
Error Responses & Edge Cases
404s and large POST bodies with bad credentials (bot traffic).
404 handling: Fastify leads. Hono and Wooks are level on both; h3 and Express are well behind.
Large body + auth failure: every framework in this benchmark checks auth before parsing the body, so none of them parses these bodies. Fastify is the fastest here; Wooks and Hono are level, ahead of Express and h3.
Where Wooks Leads
Cookie-authenticated reads. In the largest traffic category, Wooks has the highest throughput of the five frameworks, helped by lazy cookie parsing.
Consistently near the top. Wooks is first or second on 14 of the 20 tests and 1.02x behind Fastify on the traffic mix; Hono, h3 and Express are further behind.
Where Wooks Trails
Auth failures, 404s and login. Fastify handles these faster than Wooks, and Hono is ahead of Wooks on auth failures and level on 404s.
Fastify leads most of the non-cookie tests: static and wildcard routes, header-auth routes, small bodies, auth failures and 404s. Hono and h3 are the fastest on the large JSON body, though all five are within 13% of each other there.
The Real-World Perspective
These benchmarks measure raw framework throughput — the theoretical ceiling. In a real application, your handlers make database queries, call external APIs, and process business logic, and those take far longer than the framework's own work.
With a simulated Redis call in every authenticated handler, the gap between the fastest and the slowest framework narrows:
The fastest-to-slowest ratio drops from 1.97x to 1.69x. Wooks stays second, 1.06x behind Fastify: with the DB call Fastify is 3–6% ahead of Wooks on the cookie-auth reads and further ahead on the header-auth and wildcard routes, while Wooks stays well ahead of Hono, h3 and Express.
The bottom line
Performance alone shouldn't drive your framework choice. All five frameworks tested here handle tens of thousands of requests per second on a single process. Pick the one that gives you the best abstractions, developer experience, and ecosystem for your problem, and measure your own workload if speed matters.
What Wooks Offers
Composable API. No (req, res) threading, no middleware ordering puzzles. Just composable functions — useRequest(), useBody(), useCookies() — that work anywhere in your call stack.
Lazy by default. Cookies aren't parsed until you read one. Bodies aren't deserialized until you ask. Route params aren't extracted until accessed. If a handler rejects early, it never pays for the data it didn't read.
Type-safe from the ground up. Every composable returns typed data. No req.user as User casts, no runtime type assertions.
One pattern beyond HTTP. The same composable pattern powers CLI apps, WebSocket servers, and workflow engines. Learn one abstraction, apply it everywhere.
Built-in context management. AsyncLocalStorage-backed event context with cached() slots, typed storage, and composable factories. Every composable you write gets per-request caching, type safety, and zero-argument access.
A feature-rich router. @prostojs/router supports regex constraints, multiple wildcards, optional parameters, case-insensitive matching, and trailing slash normalization. See the router benchmark for its lookup speed.
Benchmark source: prostojs/router-benchmark. Results generated October 2026 (indicative estimate on a laptop: single round, DB mode 3 rounds).