Advanced Node.js Interview Questions

On SIGTERM, stop accepting connections, let in-flight requests finish, close database pools, then exit, with a hard timeout in case something hangs.

const server = app.listen(3000);

function shutdown(signal) {
  console.log(`${signal} received, closing`);
  server.close(async () => {   // stop accepting, wait for open requests
    await db.end();            // close the database pool
    process.exit(0);
  });
  setTimeout(() => process.exit(1), 10_000).unref(); // give up after 10 s
}

process.on('SIGTERM', () => shutdown('SIGTERM'));
process.on('SIGINT', () => shutdown('SIGINT'));

Fail the readiness probe first so the load balancer stops sending traffic. On Node 18 and earlier, idle keep-alive connections can hold server.close() open; call server.closeIdleConnections() (18.2 and later) there.

AsyncLocalStorage keeps a value that follows one async call chain, through await and timers, without passing it as an argument. The standard use is a request id in logs.

const { AsyncLocalStorage } = require('node:async_hooks');
const context = new AsyncLocalStorage();

function log(message) {
  const store = context.getStore();
  console.log(`[${store ? store.requestId : 'no request'}] ${message}`);
}

const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));

async function handleRequest(delay) {
  await sleep(delay);
  log('loaded user');
  await sleep(delay);
  log('sent response');
}

context.run({ requestId: 'req-1' }, () => handleRequest(20));
context.run({ requestId: 'req-2' }, () => handleRequest(5));
log('server started');

The requests interleave, yet each line carries the right id. OpenTelemetry uses it for context propagation.

Confirm it: heap usage that keeps rising across garbage collections under steady load. Then take two heap snapshots minutes apart (--inspect or v8.writeHeapSnapshot()), compare them, and follow the retainers. Usual culprits: an unbounded Map cache, listeners added per request to a long-lived emitter (MaxListenersExceededWarning), setInterval timers never cleared, and closures that capture a whole request.

The common ones: injection (use parameterized SQL, and execFile with an argument array for shell commands), prototype pollution from deep-merging user JSON (below), ReDoS from a regex such as /(a+)+$/ that blocks the event loop on a crafted string, path traversal through names like ../../etc/passwd, vulnerable dependencies (npm audit, a committed lock file) and secrets in code or logs. Add helmet, rate limiting, schema validation and error responses without stack traces.

Resolve the name against the base directory, then check the result is still inside it.

const path = require('node:path');

const UPLOADS = '/srv/uploads';

function safePath(name) {
  const full = path.resolve(UPLOADS, name);
  if (!full.startsWith(UPLOADS + path.sep)) {
    throw new Error(`blocked: ${name}`);
  }
  return full;
}

for (const name of ['report.pdf', '../../etc/passwd', 'a/../b.txt', '/etc/hosts']) {
  try {
    console.log(safePath(name));
  } catch (err) {
    console.log(err.message);
  }
}

path.resolve collapses .. and lets an absolute name replace the base, so check the resolved path, against UPLOADS + path.sep: a plain startsWith(UPLOADS) would accept /srv/uploads-old/secret.

Prototype pollution is user input writing properties onto Object.prototype, so every object inherits them, usually through a hand-written deep merge.

function merge(target, source) {
  for (const key in source) {
    if (typeof source[key] === 'object' && source[key] !== null) {
      target[key] = merge(target[key] ?? {}, source[key]);
    } else {
      target[key] = source[key];
    }
  }
  return target;
}

const payload = JSON.parse('{"__proto__": {"isAdmin": true}}');
merge({}, payload);

const user = {};
console.log(user.isAdmin); // Node.js prints: true

JSON.parse makes __proto__ an ordinary key, but target['__proto__'] reads the real prototype. Fix: skip __proto__, constructor and prototype, validate with a schema, or use a Map for user-keyed data.

Unit tests for pure logic, integration tests for routes against a real test database, a few end-to-end checks. Node has a built-in runner, node:test (stable since Node 20); Jest and Vitest are common.

// sum.test.js, run with: node --test
const test = require('node:test');
const assert = require('node:assert/strict');
const { sum } = require('./sum');

test('adds two numbers', () => {
  assert.equal(sum(2, 3), 5);
});

test('rejects bad input', async () => {
  await assert.rejects(() => Promise.reject(new TypeError('bad')), TypeError);
});

For routes, export the app without listen and drive it with supertest.

Type stripping checks nothing and rejects syntax that needs rewriting, such as enum (Node 22 and 24 accept it with --experimental-transform-types, a flag Node 26 removed). Through Node 26, even versions become LTS; from Node 27 there is one major a year and every one becomes LTS.

Run several identical, stateless instances behind a load balancer, with shared state outside the process: sessions and rate limits in Redis, uploads in object storage, cron on a queue or one elected leader, WebSocket broadcasts through pub/sub. Use every core first, then add machines. The test: you can kill any instance and users see at most one retried request.

Make it idempotent: webhooks are delivered at least once, so record each event id and skip ids already seen.

const processed = new Set();

function handlePaymentWebhook(event) {
  if (processed.has(event.id)) return `ignored duplicate ${event.id}`;
  processed.add(event.id);
  return `marked order ${event.orderId} as paid`;
}

const deliveries = [
  { id: 'evt_1', orderId: 101 },
  { id: 'evt_2', orderId: 102 },
  { id: 'evt_1', orderId: 101 }, // the provider retried the first one
];
for (const event of deliveries) console.log(handlePaymentWebhook(event));

In production the Set is a unique constraint in the database, written in the same transaction as the side effect. Answer a duplicate with 200, or the provider keeps retrying.