res.json is not a function

What happens is that you are calling res to 2+ same arguments, the one of express and the one of the objects fetch that you make, for which you are redeclarating, you must give a different name to each argument so that the argument res of express can use the json method, that is:

// Este argumento res es el que se encarga de tu res.json(); 
router.post("/users/github/:code", function(req, res) {
  var state;
  // Primer fetch 
  fetch('https://github.com/login/oauth/access_token/', {
    method: 'POST',
    headers: {
      'Accept: application/json', // Aquí te faltaba una comilla al prinicipio
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      client_id: 'xxx',
      client_secret: 'xxx',
      code: req.params.code
    })
  }).then(function(resInFetch) { // Primer res en primer fetch
    return res.json();
  }).then(function(body) {
    if (body.error !== 'bad_verification_code') {
      const token = createToken(body.access_token);
      var access_token = body.access_token;
      // Segundo fetch
      fetch('https://api.github.com/orgs/xxx/members?access_token=' + access_token, {
          method: 'GET',
          headers: {
            'Accept: application/json', // Aquí te faltaba una comilla
            'Content-Type': 'application/json'
          }
        }).then(resInSecondFetch => res.json()) // Segundo res en segundo fetch
        .then(resInSecondFetch => {
          // Tercer fetch
          fetch('https://api.github.com/user?access_token=' + access_token, {
              method: 'GET',
              headers: {
                'Accept: application/json', // Aquí te faltaba otra comilla
                'Content-Type': 'application/json'
              },
            }).then(resInThirdFetch => res.json()) // Tercer res en tercer fetch
            .then(user => {

              var username = user.login;
              var insert;
              for (insert = 0; insert < res.length; insert++) {

                if (username == res[insert].login) {
                  state = true;
                }

              };
              console.log(state)
              if (state) {
                res.json({
                  success: true,
                  access_token: body.access_token,
                  jwt: token
                });
              } else {
                res.json({
                  success: false
                });
              }
            });
        });

    } else {
      res.json({
        success: false
      });
    }

  });
});

Only for greater abundance, I think they are missing the essence of a chain of promises. Jorius' answer could be rewritten as:

// Este argumento res es el que se encarga de tu res.json(); 
router.post("/users/github/:code", function (req, res) {
  var state, token, access_token;
  // Primer fetch 
  fetch('https://github.com/login/oauth/access_token/', {
      method: 'POST',
      headers: {
        'Accept: application/json', // Aquí te faltaba una comilla al prinicipio
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({
        client_id: 'xxx',
        client_secret: 'xxx',
        code: req.params.code
      })
    }).then(function (resInFetch) { // Primer res en primer fetch
      return res.json();
    }).then(function (body) {
      if (body.error === 'bad_verification_code') {
        throw new Error('bad_verification_code');
      }
      token = createToken(body.access_token);
      access_token = body.access_token;
      // Segundo fetch
      return fetch('https://api.github.com/orgs/xxx/members?access_token=' + access_token, {
        method: 'GET',
        headers: {
          'Accept: application/json', // Aquí te faltaba una comilla
          'Content-Type': 'application/json'
        }
      });
    }).then(resInSecondFetch => res.json()) // Segundo res en segundo fetch
    .then(resInSecondFetch => {
      // Tercer fetch
      return fetch('https://api.github.com/user?access_token=' + access_token, {
        method: 'GET',
        headers: {
          'Accept: application/json', // Aquí te faltaba otra comilla
          'Content-Type': 'application/json'
        },
      });
    }).then(resInThirdFetch => res.json()) // Tercer res en tercer fetch
    .then(user => {

      var username = user.login;
      var insert;
      for (insert = 0; insert < res.length; insert++) {

        if (username == res[insert].login) {
          state = true;
        }

      };
      console.log(state)
      if (state) {
        res.json({
          success: true,
          access_token: body.access_token,
          jwt: token
        });
      } else {
        res.json({
          success: false
        });
      }
    }).catch(function (err) {
      console.error(err);
      res.json({
        success: false
      });

    });

});