I wouldn't exactly call this a failure of the JS ecosystem. The Express documentation you've linked to mentions that the host is the (optional) second argument

I wouldn't exactly call this a failure of the JS ecosystem. The Express documentation you've linked to mentions that the host is the (optional) second argument to the listen function: > app.listen([port[, host[, backlog]]][, callback]) You literally just have to run: app.listen(3000, '127.0.0.1') If you don't trust the network you're on you should just be explicit about which IP address you'd like to listen on.