I wouldn't exactly call this a failure of the JS ecosystem. The Express documentation you've linked to mentions that the host is the (optional) second argument to the listen function:

> app.listen([port[, host[, backlog]]][, callback])

You literally just have to run:

  app.listen(3000, '127.0.0.1')

If you don't trust the network you're on you should just be explicit about which IP address you'd like to listen on.