canirequire

canirequire › CommonJS › cors

Is cors ESM-only? Can you require() it?

Node.js CORS middleware

Last verified Sep 9, 2026 against cors@2.8.6. Markdown · JSON

CommonJS CommonJS — require() works on every Node.js version we test

cors ships CommonJS only. require("cors") works on every Node.js version we test (18, 20, 22, 24 and 26) and in Bun. The package declares Node.js >= 0.10. import "cors" also works because Node.js and Bun can import CommonJS from ES modules, but only the default export is guaranteed; named imports depend on Node's static analysis of the module.

What to do

  1. require("cors") works on every Node.js version we test (18, 20, 22, 24 and 26) and in Bun. The package declares Node.js >= 0.10.
  2. From ES modules use the default import: import cors from "cors"; then destructure. Named imports only work when Node.js can statically detect the exports.
  3. TypeScript: npm install -D @types/cors
Latest
2.8.6 (Jan 22, 2026)
Module format
CommonJS
Last CommonJS version
2.8.6
TypeScript types
@types/cors
Node engines
>= 0.10
Weekly downloads
69.7M
License
MIT

Does cors@2.8.6 actually load? Runtime test results

Installed and executed on Sep 9, 2026 with require("cors") from a CommonJS file and import "cors" from an ES module.

Runtimerequire("cors")import "cors"
Node.js 18✓ works✓ works
Node.js 20✓ works✓ works
Node.js 22✓ works✓ works
Node.js 24✓ works✓ works
Node.js 26✓ works✓ works
Bun 1.4.0✓ works✓ works

How to import cors

ES modules (import)

import cors from "cors";

Named imports from a CommonJS package only work when Node.js can statically detect them. If a named import fails, use the default import and destructure.

CommonJS (require)

const cors = require("cors");

Module format by version

Derived from the type, main and exports fields of every stable release on npm, corrected where a runtime test of that version contradicted them (35 versions; the newest 35 shown).

VersionsFormatFirst published
0.0.1 – 2.8.6CommonJSJan 31, 2013

Frequently asked

Is cors ESM-only?

cors@2.8.6 is a CommonJS package. cors ships CommonJS only. require("cors") works on every Node.js version we test (18, 20, 22, 24 and 26) and in Bun. The package declares Node.js >= 0.10. import "cors" also works because Node.js and Bun can import CommonJS from ES modules, but only the default export is guaranteed; named imports depend on Node's static analysis of the module.

Can I import cors with ES module syntax?

Yes. import cors from "cors" works in Node.js and Bun because they support importing CommonJS modules. Named imports work only when Node.js can statically detect the exports.

Does cors work in Bun?

Yes. import "cors" loaded successfully in Bun 1.4.0 on Sep 9, 2026.

Does cors ship TypeScript types?

Not bundled. Install the community types with "npm install -D @types/cors".

Links

Other commonjs packages

Similar popularity