We are using Koa in production, and the library is still being maintained.
IMH, the upside is that it's a light abstraction of the node's HTTP request. All extensions are provided in different packages (unlike express).
The downside is that you need to set up the basics (like routers[0]) that are out-of-the-box.