Node.js Interview Questions and Answers

Node.js is a JavaScript runtime: it runs JavaScript outside the browser on Google's V8 engine, with libuv for the event loop and asynchronous I/O. It is not a framework; Express runs on it. It adds file system, network and process access, and has no DOM. It suits servers because I/O does not block. More in the Node.js runtime.

The REPL (Read, Eval, Print, Loop) is the interactive shell you get by running node with no file. Use it to try an API without creating a file.

$ node
> [1, 2, 3].map((n) => n * 2)
[ 2, 4, 6 ]
> _.length
3
> .exit

_ holds the last result, .editor accepts several lines at once, and top-level await works.

Your JavaScript runs on one thread, but the process is not single-threaded. libuv keeps a thread pool (4 threads by default) for work the OS cannot do asynchronously, such as most fs calls, dns.lookup and zlib; network sockets use the OS's own async I/O. Results come back as callbacks on the main thread. To run JavaScript in parallel, use worker_threads or cluster.

The language is the same; the APIs around it differ.

Both have fetch (Node since 18, stable in 21). In Node.js setTimeout returns a Timeout object, in the browser a number.

Blocking code makes the thread wait until the work is done; non-blocking code starts it and delivers the result later through a callback, promise or event. fs.readFileSync blocks, fs.readFile does not.

const fs = require('node:fs');

fs.writeFileSync('demo.txt', 'hello');

console.log('1. sync read:', fs.readFileSync('demo.txt', 'utf8'));

fs.readFile('demo.txt', 'utf8', (err, data) => {
  console.log('3. async read:', data);
  fs.unlinkSync('demo.txt');
});

console.log('2. after the readFile call');

Sync calls are fine at startup; inside a request handler they stall every other request.

npm is the package manager that ships with Node.js: it installs packages into node_modules and records them in package.json. npx runs a package's command line tool, downloading it temporarily if needed, so you need no global installs. See npm basics.

npm init -y              # create package.json
npm install express      # add a dependency
npm install -D vitest    # add a dev dependency
npm run test             # run the "test" script from package.json
npx eslint .             # run a tool without a global install

dependencies are needed at runtime (express). devDependencies only build and test (vitest) and are skipped by npm install --omit=dev. peerDependencies must be provided by the app, so a plugin does not bring a second copy of React; npm 7 and later install them automatically. More in package.json.

Semver ranges. ~1.4.2 allows patch updates (<1.5.0); ^1.4.2, npm's default, allows minor and patch updates (<2.0.0). The trap: below 1.0.0, ^0.4.2 allows only patches (<0.5.0), because a 0.x minor release may break things.

package-lock.json records the exact version and hash of every installed package, transitive ones included, so installs are reproducible; commit it. npm install may update the lock file. npm ci installs exactly what it says, deletes node_modules first, and fails if it disagrees with package.json. Use npm ci in CI and Docker builds.

The Node.js callback convention: the first argument is an error or null, the rest are results. util.promisify relies on it.

function divide(a, b, callback) {
  setTimeout(() => {
    if (b === 0) return callback(new Error('division by zero'));
    callback(null, a / b);
  }, 0);
}

function print(err, result) {
  if (err) return console.log('error:', err.message);
  console.log('result:', result);
}

divide(10, 2, print);
divide(1, 0, print);

Two rules: return after calling back with an error, and never call the callback twice. More in callbacks.

Callback hell is each async step nested inside the previous callback, so the code drifts right and every level repeats its error check. The fix is async/await: flat code with one try/catch, using util.promisify or Node's promise APIs (fs/promises).

const { promisify } = require('node:util');

function getUser(id, cb) { setTimeout(() => cb(null, { id, name: 'Ada' }), 1); }
function getOrders(user, cb) { setTimeout(() => cb(null, [`${user.name}-1`, `${user.name}-2`]), 1); }
function getInvoice(order, cb) { setTimeout(() => cb(null, `invoice for ${order}`), 1); }

// callback hell: every step nests one level deeper and repeats the error check
getUser(7, (err, user) => {
  if (err) return console.log(err.message);
  getOrders(user, (err, orders) => {
    if (err) return console.log(err.message);
    getInvoice(orders[0], (err, invoice) => {
      if (err) return console.log(err.message);
      console.log('callbacks:', invoice);
      flat();
    });
  });
});

// the same steps, flat
async function flat() {
  try {
    const user = await promisify(getUser)(7);
    const orders = await promisify(getOrders)(user);
    console.log('async/await:', await promisify(getInvoice)(orders[0]));
  } catch (err) {
    console.log(err.message);
  }
}

EventEmitter from node:events is the publish/subscribe class behind streams, servers and sockets: on registers a listener, emit calls the listeners.

const EventEmitter = require('node:events');

class Order extends EventEmitter {
  pay(amount) {
    this.emit('paid', amount);
  }
}

const order = new Order();
order.on('paid', (amount) => console.log('send receipt for', amount));
order.once('paid', () => console.log('first payment only'));

order.pay(250);
order.pay(100);
console.log('listeners left:', order.listenerCount('paid'));

emit is synchronous: it calls every listener, in order, before it returns. once removes its listener after the first call.

__dirname and __filename are the directory and file path of the current CommonJS module. process describes the running process (env, argv, exit()). global is the global object, also globalThis. ES modules have no __dirname: use import.meta.dirname (Node 20.11 and later) or derive it:

import { fileURLToPath } from 'node:url';
import path from 'node:path';

const __filename = fileURLToPath(import.meta.url);
const __dirname = path.dirname(__filename);

NODE_ENV is a convention that libraries read to choose development or production behavior; Node.js itself ignores it. With production, Express caches view templates and hides stack traces, and npm install skips devDependencies. Read it once into a config object instead of branching on it across the codebase.

process.argv holds the node binary, the script, then your arguments from index 2. For flags, use the built-in util.parseArgs (Node 18.3 and later).

// node greet.js --name Ada --loud
const { parseArgs } = require('node:util');

const { values } = parseArgs({
  args: process.argv.slice(2),
  options: {
    name: { type: 'string', default: 'world' },
    loud: { type: 'boolean' },
  },
});
const text = `hello ${values.name}`;
console.log(values.loud ? text.toUpperCase() : text);
// HELLO ADA

Use Node.js for I/O bound services: APIs, chat and WebSockets, proxies, streaming, CLI tools. Waiting costs almost nothing, so one thread holds thousands of connections. Avoid it for CPU bound work such as video encoding or ML training: a long computation blocks the event loop and every request waits, unless you move it to worker_threads or another service.

The event loop is libuv's loop that runs ready callbacks on the main thread. Each turn has six phases, each with its own queue:

1. timers: due setTimeout and setInterval callbacks
2. pending callbacks: some deferred system I/O callbacks
3. idle, prepare: internal
4. poll: wait for and run I/O callbacks
5. check: setImmediate callbacks
6. close callbacks: 'close' events

After every callback (timers and setImmediate too, since Node 11), Node drains process.nextTick, then promise microtasks. See the event loop.

process.nextTick runs right after the current operation, before promise callbacks (in CommonJS; see the ES module question). setImmediate runs in the check phase, after I/O polling. setTimeout(fn, 0) runs in the timers phase after at least 1 ms.

// Node.js, CommonJS file
setTimeout(() => console.log('timeout'), 0);
setImmediate(() => console.log('immediate'));
Promise.resolve().then(() => console.log('promise'));
process.nextTick(() => console.log('nextTick'));
console.log('sync');

Node prints sync, nextTick, promise, then timeout and immediate in either order. The names are backwards: nextTick is the immediate one, and a recursive nextTick can starve I/O.

From the main module it is not guaranteed: it depends on whether 1 ms has passed when the loop reaches the timers phase. Inside an I/O callback setImmediate always runs first, because check comes right after poll.

const fs = require('node:fs');

fs.readFile(__filename, () => {
  setTimeout(() => console.log('timeout'), 0);
  setImmediate(() => console.log('immediate'));
});
// Node.js always prints:
// immediate
// timeout

setImmediate is a Node.js API, not a web standard, so this order is a Node.js rule; see setImmediate vs setTimeout.

Because an ES module's top-level code runs inside a promise job. When a CommonJS file ends, Node drains nextTick first, then microtasks. An ES module body ends while microtasks are already draining, so its promise callbacks run first.

process.nextTick(() => console.log('nextTick'));
Promise.resolve().then(() => console.log('promise'));
console.log('sync');

The process.nextTick docs show both orders. Never depend on this order; make it explicit with await.

Everything waits: timers fire late, requests queue up, health checks time out.

const start = Date.now();

setTimeout(() => {
  const waited = Date.now() - start;
  console.log('asked for 10 ms, waited at least 200:', waited >= 200);
}, 10);

// 200 ms of synchronous work, like a huge JSON.parse or a sync crypto call
while (Date.now() - start < 200) {}
console.log('busy loop done');

Common causes: JSON.parse on huge payloads, sync fs or crypto in a handler, a regex with catastrophic backtracking. Measure with perf_hooks.monitorEventLoopDelay(); fix by chunking with setImmediate or a worker thread.

A pool of threads (4 by default) that libuv uses for work the OS cannot do asynchronously. Your JavaScript never runs there.

The trap: with 4 threads, 8 concurrent pbkdf2 calls take about twice as long as 4. Raise it with the UV_THREADPOOL_SIZE environment variable before Node starts (maximum 1024).

A waiting connection costs almost nothing: Node registers each socket with the OS (epoll, kqueue, IOCP) and runs code only when data arrives, where a thread-per-request server parks a thread per client. The limit is CPU per request: at 5 ms of JavaScript each, one process tops out near 200 requests per second.

Use util.promisify for any function with an error-first callback, or the promise APIs Node ships: fs/promises, timers/promises, stream/promises.

const util = require('node:util');

function legacyDouble(x, callback) {
  setTimeout(() => {
    if (x < 0) return callback(new Error('negative input'));
    callback(null, x * 2);
  }, 1);
}

const double = util.promisify(legacyDouble);

async function main() {
  console.log(await double(21));
  try {
    await double(-1);
  } catch (err) {
    console.log('caught:', err.message);
  }
}
main();

They differ in when they settle:

const ok = (ms, value) => new Promise((resolve) => setTimeout(() => resolve(value), ms));
const fail = (ms, msg) => new Promise((_, reject) => setTimeout(() => reject(new Error(msg)), ms));

async function main() {
  try {
    await Promise.all([ok(20, 'a'), fail(10, 'b failed'), ok(30, 'c')]);
  } catch (err) {
    console.log('all:', err.message);
  }
  const settled = await Promise.allSettled([ok(20, 'a'), fail(10, 'b failed')]);
  console.log('allSettled:', settled.map((r) => r.status).join(', '));
  console.log('race:', await Promise.race([ok(20, 'slow'), ok(5, 'fast')]));
  console.log('any:', await Promise.any([fail(5, 'x'), ok(20, 'first success')]));
}
main();

When Promise.all rejects, the other operations keep running; nothing is cancelled.

CommonJS (require) is Node's original synchronous system; ES modules (import) are the standard, linked before the code runs.

Since Node 22.12 (and 20.19), CommonJS can require() an ES module without top-level await. See CommonJS vs ES modules.

Node wraps each CommonJS file in a function called with exports, require, module, __filename and __dirname, so those names are local to each file.

// a CommonJS file: these names come from the module wrapper
console.log(arguments.length);
console.log(typeof exports, typeof require, typeof module);
console.log(typeof __filename, typeof __dirname);
console.log(require.main === module);

require resolves the path, runs the file once, caches module.exports and returns it. require.main === module means the file was run directly.

Yes. The first require runs the file and caches it by resolved path; later calls return the same module.exports. So an exported database pool is a singleton per process.

// counter.js
let count = 0;
module.exports = { next: () => ++count };

// app.js
const a = require('./counter');
const b = require('./counter');
console.log(a === b, a.next(), b.next()); // true 1 2

Traps: one package installed in two node_modules folders gives two instances, and each cluster worker or worker thread has its own cache.

In this order:

1. Core modules: fs or node:fs (node:test exists only with the prefix).
2. A path starting with ./, ../ or /: the exact name, then .js, .json, .node, then a folder's main or index.js.
3. A package: node_modules in this folder, then in each parent up to the root, then the package's exports field (or main).

ES modules do not try extensions, and exports blocks paths it does not list.

Node hands out a partly filled module. When a.js and b.js require each other, b gets a's module.exports as it is at that moment.

// a.js
exports.loaded = false;
const b = require('./b');
console.log('in a, b.loaded =', b.loaded);
exports.loaded = true;

// b.js
const a = require('./a');
console.log('in b, a.loaded =', a.loaded);
exports.loaded = true;

// node a.js prints:
// in b, a.loaded = false
// in a, b.loaded = true

In ES modules, reading an imported let, const or class too early throws a ReferenceError. Fix the design: move the shared code into a third module, or require lazily inside a function.

import() loads a module at runtime and returns a promise for it, in CommonJS and ES modules, with any expression as the specifier.

async function load(name) {
  // the module is chosen at runtime, which a static import cannot do
  return import(name);
}

load('node:path').then((path) => {
  console.log(path.join('reports', '2026', 'march.csv'));
  console.log(path.extname('archive.tar.gz'));
});

Use it to load an ES-only package from CommonJS, plugins named in config, or a heavy module only when needed.

.mjs is always an ES module, .cjs always CommonJS. A .js file follows the nearest package.json "type": "module" means ESM, "commonjs" CommonJS. With no type field (or no package.json), Node 22.7 and later try CommonJS first and rerun a file that uses import or export as ESM (syntax detection); that costs a second parse and warns when a package.json exists, so set "type" explicitly. See ES modules.

A Buffer is a fixed-length chunk of raw bytes (a Uint8Array subclass) for binary data. Strings are text, buffers are bytes, and an encoding converts between them.

const buf = Buffer.from('Hi Node', 'utf8');

console.log(buf.length);
console.log(buf.toString('hex'));
console.log(buf.toString('base64'));
console.log(Buffer.from('SGkgTm9kZQ==', 'base64').toString('utf8'));
console.log(buf[0], String.fromCharCode(buf[0]));

new Buffer() is deprecated; use Buffer.from or Buffer.alloc.

Buffer.alloc(n) returns n zeroed bytes. Buffer.allocUnsafe(n) skips the zeroing, so it is faster, but may hold old data, including secrets from other requests. Use it only when you overwrite every byte at once.

A stream processes data piece by piece instead of loading it all into memory. The four types: Readable (fs.createReadStream, an HTTP request), Writable (an HTTP response), Duplex (a TCP socket) and Transform, a Duplex that changes the data (zlib.createGzip()).

const { Readable, Transform } = require('node:stream');
const { pipeline } = require('node:stream/promises');

let calls = 0;
const upper = new Transform({
  transform(chunk, encoding, callback) {
    calls++;
    callback(null, chunk.toString().toUpperCase());
  },
});

async function main() {
  const out = [];
  await pipeline(
    Readable.from(['stream ', 'data ', 'in chunks']),
    upper,
    async function (source) {
      for await (const chunk of source) out.push(chunk.toString());
    },
  );
  console.log(out.join(''));
  console.log('transform calls:', calls);
}
main();

Readable streams are async iterables, so for await is the simplest way to consume one.

Memory and time to first byte. readFile loads the whole file first, so a 2 GB file needs 2 GB of RAM per download. A stream sends 64 KiB chunks as they are read, so memory stays flat.

const fs = require('node:fs');
const http = require('node:http');
const { pipeline } = require('node:stream/promises');

http.createServer(async (req, res) => {
  res.setHeader('Content-Type', 'video/mp4');
  try {
    await pipeline(fs.createReadStream('movie.mp4'), res);
  } catch (err) {
    console.error('download failed:', err.code);
  }
}).listen(3000);

pipeline also closes the file stream if the client disconnects.

Backpressure is a producer outrunning its consumer. A writable returns false from write() once its buffer passes highWaterMark (64 KiB by default in Node 22 and later); the producer should then wait for 'drain'.

function writeLines(stream, lines, done) {
  let i = 0;
  function writeSome() {
    while (i < lines.length) {
      const ok = stream.write(lines[i++] + '\n');
      if (!ok) return stream.once('drain', writeSome); // buffer full, wait
    }
    done();
  }
  writeSome();
}

pipe() and pipeline() do this for you. The bug to spot: a write() loop that ignores the return value runs out of memory in production.

Both connect streams with backpressure, but pipe() does not forward errors: a failed source leaves the destination open, and an unhandled 'error' crashes the process. pipeline() destroys every stream when one fails and gives you one place to catch.

// leaks the file stream on failure, and a gzip error crashes the process
source.pipe(zlib.createGzip()).pipe(fs.createWriteStream('out.gz'));

// one try/catch, everything cleaned up
await pipeline(source, zlib.createGzip(), fs.createWriteStream('out.gz'));

Use readline on a read stream: it is an async iterable and holds only the current chunk.

const fs = require('node:fs');
const readline = require('node:readline');

fs.writeFileSync('access.log', 'GET /home 200\nGET /cart 500\nPOST /pay 200\n');

async function countErrors(file) {
  const rl = readline.createInterface({
    input: fs.createReadStream(file),
    crlfDelay: Infinity, // treat \r\n as a single line break
  });
  let lines = 0;
  let errors = 0;
  for await (const line of rl) {
    lines++;
    if (line.endsWith(' 500')) errors++;
  }
  return { lines, errors };
}

countErrors('access.log').then(({ lines, errors }) => {
  console.log(`${errors} of ${lines} requests failed`);
  fs.unlinkSync('access.log');
});

It reads a 10 GB log in kilobytes of memory, unlike readFile plus split('\n').

Express is a minimal web framework on Node's http module that adds routing, middleware, body parsing and helpers such as res.json.

const express = require('express');
const app = express();

app.use(express.json()); // parse JSON bodies into req.body

app.get('/users/:id', (req, res) => {
  res.json({ id: req.params.id });
});

app.listen(3000, () => console.log('listening on 3000'));

Alternatives: Fastify (faster, schema validation), NestJS (dependency injection, on Express or Fastify) and Koa.

A function (req, res, next) that runs during a request, in registration order. It can change req and res, end the response, or call next(). Logging, auth and body parsing are middleware.

function requestTimer(req, res, next) {
  const start = Date.now();
  res.on('finish', () => {
    console.log(req.method, req.url, res.statusCode, Date.now() - start, 'ms');
  });
  next();
}

function requireAuth(req, res, next) {
  if (!req.headers.authorization) {
    return res.status(401).json({ error: 'missing token' });
  }
  next();
}

app.use(requestTimer);                        // every route
app.get('/orders', requireAuth, listOrders);  // one route

Classic bugs: neither calling next() nor responding hangs the request; calling next() after responding lets a later handler respond again, which throws "Cannot set headers after they are sent to the client".

req.params holds route segments (/users/:id), req.query the query string (?page=2), req.body the parsed body. Params and query values are strings, so convert and validate them, and req.body is undefined without a parser such as express.json().

Add a middleware with four parameters (err, req, res, next) after all routes; errors passed to next(err) or thrown in a handler go there.

app.get('/users/:id', async (req, res) => {
  const user = await db.findUser(req.params.id); // may reject
  if (!user) {
    const err = new Error('user not found');
    err.status = 404;
    throw err;
  }
  res.json(user);
});

// last; the four parameters are how Express recognizes it
app.use((err, req, res, next) => {
  console.error(err);
  res.status(err.status ?? 500).json({ error: err.status ? err.message : 'internal error' });
});

Express 5 forwards a rejected async handler there too. Express 4 does not: the request hangs and, on Node 15 and later, the process crashes, so catch and call next(err).

express.Router() is a mini app with its own routes and middleware, mounted under a prefix to split an API into files.

// routes/users.js
const express = require('express');
const router = express.Router();

router.get('/', listUsers);     // GET /api/users
router.get('/:id', getUser);    // GET /api/users/42
router.post('/', createUser);   // POST /api/users

module.exports = router;

// app.js
app.use('/api/users', require('./routes/users'));

Keep routes thin: they parse input and call a service, which holds the business logic, so it stays testable without HTTP.

app.get matches only GET (and HEAD) on the exact path. app.use matches every method and every path under the prefix, and strips the prefix from req.url. Mount routers and middleware with use, endpoints with get or post.

app.use('/api', apiLogger);       // GET /api/users, POST /api/orders/7, ...
app.get('/api/users', listUsers); // only GET /api/users

CORS is a browser rule: a page may read a response from another origin only if the API's headers allow it. Only browsers enforce it, so it does not protect your API. For JSON bodies, custom headers or PUT, the browser first sends an OPTIONS preflight.

const cors = require('cors');

app.use(cors({
  origin: ['https://app.example.com'], // never '*' when sending cookies
  credentials: true,
}));

With node:http: createServer takes a (req, res) handler for every request, and routing and parsing are yours.

const http = require('node:http');

const server = http.createServer((req, res) => {
  const url = new URL(req.url, 'http://localhost');
  res.writeHead(200, { 'Content-Type': 'application/json' });
  res.end(JSON.stringify({ path: url.pathname, x: url.searchParams.get('x') }));
});

server.listen(0, () => {
  const { port } = server.address();
  http.get(`http://127.0.0.1:${port}/hello?x=1`, (res) => {
    let body = '';
    res.setEncoding('utf8');
    res.on('data', (chunk) => (body += chunk));
    res.on('end', () => {
      console.log(res.statusCode, res.headers['content-type'], body);
      server.close();
    });
  });
});

Port 0 asks the OS for any free port, the usual trick in tests.

Wrap the await in try/catch: a rejected promise throws at the await. Put cleanup in finally.

async function fetchUser(id) {
  if (id <= 0) throw new Error(`invalid id ${id}`);
  return { id, name: 'Ada' };
}

async function handler(id) {
  try {
    const user = await fetchUser(id);
    return `found ${user.name}`;
  } catch (err) {
    return `failed: ${err.message}`;
  } finally {
    console.log(`request ${id} finished`);
  }
}

async function main() {
  console.log(await handler(7));
  console.log(await handler(-1));
}
main();

finally runs before the promise settles, so request 7 finished prints before found Ada. Catch only where you can act; let the rest reach a central handler. See error handling in async code.

Since Node 15 the process crashes with exit code 1, like an uncaught exception; before 15 it only warned.

process.on('unhandledRejection', (reason) => {
  console.error('unhandled rejection:', reason);
  process.exitCode = 1;
  // log, flush, then shut down; do not carry on as if nothing happened
});

async function save() {
  throw new Error('db down');
}
save(); // no await, no .catch(): this is the bug

The handler is for logging and shutdown. The fix is at the call site: await the promise or add .catch().

No. Log and exit: after an uncaught exception the state is unknown (a half-done transaction, a held lock), and Node's documentation says resuming is unsafe.

process.on('uncaughtException', (err) => {
  console.error('fatal:', err);
  process.exit(1); // the process manager starts a clean instance
});

Let a supervisor (Kubernetes, systemd, PM2) restart it, and run several instances.

Operational errors are expected failures of a correct program: the database is down, input is invalid, a request timed out. Handle them: retry, return a 4xx or 5xx. Programmer errors are bugs, such as reading a property of undefined; log, crash, restart and fix the code. Branch on err.code (ENOENT, ECONNRESET), never on messages.

Extend Error, set name, add fields such as status, and pass the original error as cause (Node 16.9 and later).

class AppError extends Error {
  constructor(message, { status = 500, cause } = {}) {
    super(message, { cause });
    this.name = this.constructor.name;
    this.status = status;
  }
}

class NotFoundError extends AppError {
  constructor(what, options) {
    super(`${what} not found`, { status: 404, ...options });
  }
}

try {
  try {
    JSON.parse('{bad json');
  } catch (err) {
    throw new NotFoundError('config', { cause: err });
  }
} catch (err) {
  console.log(err.name, err.status, err.message);
  console.log(err instanceof AppError, err.cause instanceof SyntaxError);
}

Handlers branch on instanceof or status, not on message text. See error types.

Race the operation against a rejecting timer, and clear the timer afterwards.

function withTimeout(promise, ms) {
  let timer;
  const timeout = new Promise((_, reject) => {
    timer = setTimeout(() => reject(new Error(`timed out after ${ms} ms`)), ms);
  });
  return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
}

const sleep = (ms, value) => new Promise((resolve) => setTimeout(() => resolve(value), ms));

async function main() {
  console.log(await withTimeout(sleep(10, 'fast result'), 100));
  try {
    await withTimeout(sleep(200, 'slow result'), 50);
  } catch (err) {
    console.log(err.message);
  }
}
main();

Promise.race stops the waiting, not the work. Where cancellation is supported, pass a signal: fetch(url, { signal: AbortSignal.timeout(5000) }).

cluster forks copies of the server, usually one per core, sharing one port; the primary hands connections to workers round-robin (except on Windows).

const cluster = require('node:cluster');
const http = require('node:http');
const os = require('node:os');

if (cluster.isPrimary) {
  for (let i = 0; i < os.availableParallelism(); i++) cluster.fork();
  cluster.on('exit', (worker, code) => {
    console.log(`worker ${worker.process.pid} exited with ${code}, starting a new one`);
    cluster.fork();
  });
} else {
  http.createServer((req, res) => res.end(`handled by ${process.pid}\n`)).listen(3000);
}

Workers share no memory, so sessions and caches move to Redis. In containers the usual choice is one process per container instead.

worker_threads runs JavaScript in parallel threads in one process, each with its own V8 isolate and event loop, talking by messages or a SharedArrayBuffer. Use them for CPU-heavy work.

const { Worker, isMainThread, parentPort, workerData } = require('node:worker_threads');

function fib(n) {
  return n < 2 ? n : fib(n - 1) + fib(n - 2);
}

if (isMainThread) {
  const worker = new Worker(__filename, { workerData: 35 });
  worker.on('message', (result) => console.log('fib(35) =', result));
  worker.on('error', (err) => console.error(err));
  console.log('main thread is still free');
} else {
  parentPort.postMessage(fib(workerData));
}
// Node.js prints:
// main thread is still free
// fib(35) = 9227465

Not for I/O, which is already async. Keep a fixed pool (piscina) rather than one worker per request.

A thread is cheaper than a process, but a native crash in a worker kills the whole process, while a crashed child leaves the parent running.

exec('convert ' + userFile) is command injection. Pass user input as an argument array to execFile or spawn.

Get it off the event loop: a job queue (BullMQ, SQS) when the client can wait, replying 202 with a job id; a worker thread pool when the response needs the result; or chunking with setImmediate as a last resort. The wrong answer is async: wrapping a synchronous loop in an async function does not move it to another thread.

Measure, then tell the kinds of slow apart:

• Event loop blocked (every endpoint slow, one core at 100%): CPU profile with node --cpu-prof or --inspect, read the flame graph.
• Waiting on I/O (CPU low): time database and downstream calls, check pool limits, including the libuv pool.
• Memory pressure (RSS rising, latency spikes): GC pauses; use heap snapshots.

perf_hooks.monitorEventLoopDelay() exported as a metric shows a blocked loop.

V8 caps the old-generation heap, and past it the process dies with "JavaScript heap out of memory". Since Node 12 the default depends on available memory; read it from v8.getHeapStatistics().heap_size_limit and change it with --max-old-space-size=4096 (MiB), below the container limit. If usage grows without end it is a leak, and a bigger heap only delays the crash.

Pick by scope: an in-process LRU Map for small hot data (each process has its own copy), Redis for anything shared across instances, and HTTP caching (Cache-Control, a CDN) for public GET responses. Two traps: an unbounded Map cache is a memory leak, so cap it and expire entries; and when a hot key expires, many requests recompute it at once, so cache the in-flight promise.

On SIGTERM, stop accepting connections, let in-flight requests finish, close database pools, then exit, with a hard timeout in case something hangs.

const server = app.listen(3000);

function shutdown(signal) {
  console.log(`${signal} received, closing`);
  server.close(async () => {   // stop accepting, wait for open requests
    await db.end();            // close the database pool
    process.exit(0);
  });
  setTimeout(() => process.exit(1), 10_000).unref(); // give up after 10 s
}

process.on('SIGTERM', () => shutdown('SIGTERM'));
process.on('SIGINT', () => shutdown('SIGINT'));

Fail the readiness probe first so the load balancer stops sending traffic. On Node 18 and earlier, idle keep-alive connections can hold server.close() open; call server.closeIdleConnections() (18.2 and later) there.

AsyncLocalStorage keeps a value that follows one async call chain, through await and timers, without passing it as an argument. The standard use is a request id in logs.

const { AsyncLocalStorage } = require('node:async_hooks');
const context = new AsyncLocalStorage();

function log(message) {
  const store = context.getStore();
  console.log(`[${store ? store.requestId : 'no request'}] ${message}`);
}

const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));

async function handleRequest(delay) {
  await sleep(delay);
  log('loaded user');
  await sleep(delay);
  log('sent response');
}

context.run({ requestId: 'req-1' }, () => handleRequest(20));
context.run({ requestId: 'req-2' }, () => handleRequest(5));
log('server started');

The requests interleave, yet each line carries the right id. OpenTelemetry uses it for context propagation.

Confirm it: heap usage that keeps rising across garbage collections under steady load. Then take two heap snapshots minutes apart (--inspect or v8.writeHeapSnapshot()), compare them, and follow the retainers. Usual culprits: an unbounded Map cache, listeners added per request to a long-lived emitter (MaxListenersExceededWarning), setInterval timers never cleared, and closures that capture a whole request.

The common ones: injection (use parameterized SQL, and execFile with an argument array for shell commands), prototype pollution from deep-merging user JSON (below), ReDoS from a regex such as /(a+)+$/ that blocks the event loop on a crafted string, path traversal through names like ../../etc/passwd, vulnerable dependencies (npm audit, a committed lock file) and secrets in code or logs. Add helmet, rate limiting, schema validation and error responses without stack traces.

Resolve the name against the base directory, then check the result is still inside it.

const path = require('node:path');

const UPLOADS = '/srv/uploads';

function safePath(name) {
  const full = path.resolve(UPLOADS, name);
  if (!full.startsWith(UPLOADS + path.sep)) {
    throw new Error(`blocked: ${name}`);
  }
  return full;
}

for (const name of ['report.pdf', '../../etc/passwd', 'a/../b.txt', '/etc/hosts']) {
  try {
    console.log(safePath(name));
  } catch (err) {
    console.log(err.message);
  }
}

path.resolve collapses .. and lets an absolute name replace the base, so check the resolved path, against UPLOADS + path.sep: a plain startsWith(UPLOADS) would accept /srv/uploads-old/secret.

Prototype pollution is user input writing properties onto Object.prototype, so every object inherits them, usually through a hand-written deep merge.

function merge(target, source) {
  for (const key in source) {
    if (typeof source[key] === 'object' && source[key] !== null) {
      target[key] = merge(target[key] ?? {}, source[key]);
    } else {
      target[key] = source[key];
    }
  }
  return target;
}

const payload = JSON.parse('{"__proto__": {"isAdmin": true}}');
merge({}, payload);

const user = {};
console.log(user.isAdmin); // Node.js prints: true

JSON.parse makes __proto__ an ordinary key, but target['__proto__'] reads the real prototype. Fix: skip __proto__, constructor and prototype, validate with a schema, or use a Map for user-keyed data.

Unit tests for pure logic, integration tests for routes against a real test database, a few end-to-end checks. Node has a built-in runner, node:test (stable since Node 20); Jest and Vitest are common.

// sum.test.js, run with: node --test
const test = require('node:test');
const assert = require('node:assert/strict');
const { sum } = require('./sum');

test('adds two numbers', () => {
  assert.equal(sum(2, 3), 5);
});

test('rejects bad input', async () => {
  await assert.rejects(() => Promise.reject(new TypeError('bad')), TypeError);
});

For routes, export the app without listen and drive it with supertest.

Type stripping checks nothing and rejects syntax that needs rewriting, such as enum (Node 22 and 24 accept it with --experimental-transform-types, a flag Node 26 removed). Through Node 26, even versions become LTS; from Node 27 there is one major a year and every one becomes LTS.

Run several identical, stateless instances behind a load balancer, with shared state outside the process: sessions and rate limits in Redis, uploads in object storage, cron on a queue or one elected leader, WebSocket broadcasts through pub/sub. Use every core first, then add machines. The test: you can kill any instance and users see at most one retried request.

Make it idempotent: webhooks are delivered at least once, so record each event id and skip ids already seen.

const processed = new Set();

function handlePaymentWebhook(event) {
  if (processed.has(event.id)) return `ignored duplicate ${event.id}`;
  processed.add(event.id);
  return `marked order ${event.orderId} as paid`;
}

const deliveries = [
  { id: 'evt_1', orderId: 101 },
  { id: 'evt_2', orderId: 102 },
  { id: 'evt_1', orderId: 101 }, // the provider retried the first one
];
for (const event of deliveries) console.log(handlePaymentWebhook(event));

In production the Set is a unique constraint in the database, written in the same transaction as the side effect. Answer a duplicate with 200, or the provider keeps retrying.

Keep a Map from event name to an array of listeners.

class MiniEmitter {
  #listeners = new Map();

  on(event, fn) {
    if (!this.#listeners.has(event)) this.#listeners.set(event, []);
    this.#listeners.get(event).push(fn);
    return this;
  }

  off(event, fn) {
    const list = this.#listeners.get(event) ?? [];
    this.#listeners.set(event, list.filter((l) => l !== fn && l.original !== fn));
    return this;
  }

  once(event, fn) {
    const wrapper = (...args) => {
      this.off(event, wrapper);
      fn.apply(this, args);
    };
    wrapper.original = fn;
    return this.on(event, wrapper);
  }

  emit(event, ...args) {
    const list = this.#listeners.get(event);
    if (!list || list.length === 0) {
      if (event === 'error') throw args[0];
      return false;
    }
    for (const fn of [...list]) fn.apply(this, args);
    return true;
  }
}

const e = new MiniEmitter();
const greet = (name) => console.log('hello', name);
e.on('join', greet);
e.once('join', (name) => console.log('first join was', name));
e.emit('join', 'Ada');
e.emit('join', 'Linus');
e.off('join', greet);
console.log(e.emit('join', 'nobody'));

Details that get checked: emit loops over a copy, so a once listener removing itself does not skip the next one, and off finds once wrappers through original.

Return a function that creates a promise and calls the original with an extra error-first callback that settles it.

function promisify(fn) {
  return function (...args) {
    return new Promise((resolve, reject) => {
      fn.call(this, ...args, (err, value) => {
        if (err) reject(err);
        else resolve(value);
      });
    });
  };
}

function readConfig(name, callback) {
  setTimeout(() => {
    if (name !== 'app') return callback(new Error(`no config named ${name}`));
    callback(null, { port: 8080 });
  }, 1);
}

const readConfigAsync = promisify(readConfig);
readConfigAsync('app').then((cfg) => console.log('port', cfg.port));
readConfigAsync('db').catch((err) => console.log(err.message));

A regular function, not an arrow, keeps this for methods.

Start limit runners; each takes the next index from a shared counter until none are left.

async function mapLimit(items, limit, worker) {
  const results = new Array(items.length);
  let next = 0;

  async function runner() {
    while (next < items.length) {
      const i = next++;
      results[i] = await worker(items[i], i);
    }
  }

  const runners = Array.from({ length: Math.min(limit, items.length) }, runner);
  await Promise.all(runners);
  return results;
}

const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
let active = 0;
let peak = 0;

async function fetchPage(id) {
  active++;
  peak = Math.max(peak, active);
  await sleep(10 + (id % 3) * 5);
  active--;
  return `page ${id}`;
}

mapLimit([1, 2, 3, 4, 5, 6, 7], 3, fetchPage).then((pages) => {
  console.log(pages.join(', '));
  console.log('max at once:', peak);
});

next++ needs no lock, because JavaScript runs one callback at a time, and storing results by index keeps the input order.

Loop over attempts, await the call inside try, and on failure wait base * 2^attempt.

const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));

async function retry(fn, { retries = 3, baseMs = 10 } = {}) {
  for (let attempt = 0; ; attempt++) {
    try {
      return await fn(attempt);
    } catch (err) {
      if (attempt >= retries) throw err;
      const delay = baseMs * 2 ** attempt;
      console.log(`attempt ${attempt + 1} failed (${err.message}), retrying in ${delay} ms`);
      await sleep(delay);
    }
  }
}

let calls = 0;
async function flakyRequest() {
  calls++;
  if (calls < 3) throw new Error('ECONNRESET');
  return `ok after ${calls} calls`;
}

retry(flakyRequest).then(console.log);

Add random jitter, retry only transient errors (ECONNRESET, 503, 429), and never retry a payment without an idempotency key.

A Map keeps insertion order, so if every read moves its key to the end, the first key is the least recently used.

class LRUCache {
  constructor(capacity) {
    this.capacity = capacity;
    this.map = new Map();
  }

  get(key) {
    if (!this.map.has(key)) return undefined;
    const value = this.map.get(key);
    this.map.delete(key); // move to the newest position
    this.map.set(key, value);
    return value;
  }

  set(key, value) {
    if (this.map.has(key)) this.map.delete(key);
    this.map.set(key, value);
    if (this.map.size > this.capacity) {
      const oldest = this.map.keys().next().value;
      this.map.delete(oldest);
    }
  }
}

const cache = new LRUCache(2);
cache.set('a', 1);
cache.set('b', 2);
cache.get('a');    // a is now the most recent
cache.set('c', 3); // evicts b, the least recently used
console.log([...cache.map.keys()].join(','), cache.get('b'));

Both operations are O(1). The classic version is a hash map plus a doubly linked list.

Count with a Map while streaming, and carry over a word cut in half at a chunk boundary.

const { Readable } = require('node:stream');

async function topWords(stream, k) {
  const counts = new Map();
  const add = (w) => counts.set(w, (counts.get(w) ?? 0) + 1);
  let leftover = '';
  for await (const chunk of stream) {
    const words = (leftover + chunk.toString()).toLowerCase().split(/\s+/);
    leftover = words.pop(); // the last word may continue in the next chunk
    for (const w of words) if (w) add(w);
  }
  if (leftover) add(leftover);
  return [...counts]
    .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
    .slice(0, k);
}

// the chunks split "dog" on purpose, like a real stream can
const source = Readable.from(['the cat and the d', 'og and the bird ', 'saw the cat']);
topWords(source, 3).then((top) => {
  for (const [word, n] of top) console.log(word, n);
});

Without leftover, d and og count as two words. For a large vocabulary and small k, use a min-heap of size k: O(n log k).

A topological sort. Kahn's algorithm: start with packages that have no unmet dependencies and release each package once everything it needs is installed.

function installOrder(deps) {
  const pending = new Map();    // package -> number of unmet dependencies
  const dependents = new Map(); // package -> packages that need it
  for (const [pkg, needs] of Object.entries(deps)) {
    pending.set(pkg, (pending.get(pkg) ?? 0) + needs.length);
    for (const d of needs) {
      if (!pending.has(d)) pending.set(d, 0);
      if (!dependents.has(d)) dependents.set(d, []);
      dependents.get(d).push(pkg);
    }
  }
  const ready = [...pending].filter(([, n]) => n === 0).map(([pkg]) => pkg);
  const order = [];
  while (ready.length) {
    const pkg = ready.shift();
    order.push(pkg);
    for (const next of dependents.get(pkg) ?? []) {
      pending.set(next, pending.get(next) - 1);
      if (pending.get(next) === 0) ready.push(next);
    }
  }
  if (order.length !== pending.size) throw new Error('dependency cycle');
  return order;
}

console.log(installOrder({
  app: ['express', 'pg'],
  express: ['body-parser'],
  'body-parser': [],
  pg: [],
}).join(' > '));

try {
  installOrder({ a: ['b'], b: ['a'] });
} catch (err) {
  console.log(err.message);
}

O(V + E); leftover packages mean a cycle. See the topological sort visualization.

Sweep the timeline: +1 at each start, -1 at each end, sorted, with a running total.

function peakConcurrency(requests) {
  const events = [];
  for (const { start, end } of requests) {
    events.push([start, 1]);
    events.push([end, -1]);
  }
  // at equal times, ends come before starts: a request ending at 30
  // does not overlap one starting at 30
  events.sort((a, b) => a[0] - b[0] || a[1] - b[1]);
  let current = 0;
  let peak = 0;
  for (const [, change] of events) {
    current += change;
    peak = Math.max(peak, current);
  }
  return peak;
}

const log = [
  { start: 0, end: 30 },
  { start: 5, end: 10 },
  { start: 15, end: 20 },
  { start: 8, end: 18 },
  { start: 30, end: 40 },
];
console.log(peakConcurrency(log));

O(n log n). It is the meeting rooms problem, and it sizes a connection pool from real traffic.

Two pointers: always take the earlier of the two current lines.

function mergeLogs(a, b) {
  const out = [];
  let i = 0;
  let j = 0;
  while (i < a.length && j < b.length) {
    out.push(a[i].ts <= b[j].ts ? a[i++] : b[j++]);
  }
  while (i < a.length) out.push(a[i++]);
  while (j < b.length) out.push(b[j++]);
  return out;
}

const api = [
  { ts: 1, msg: 'api start' },
  { ts: 4, msg: 'api request' },
  { ts: 9, msg: 'api stop' },
];
const db = [
  { ts: 2, msg: 'db connect' },
  { ts: 4, msg: 'db query' },
  { ts: 7, msg: 'db slow query' },
];
for (const line of mergeLogs(api, db)) console.log(line.ts, line.msg);

<= keeps the merge stable at ties; O(n + m). For k files, keep each file's current line in a min-heap.