http://expressjs.com/advanced/security-updates.html
Yeah I think I'm going to take my chances with Express.js rather than Ruby on Rails with it 57 vulnerabilities in 6 years.