Node.js Interview Questions & Answers

What is the Node.js runtime, and how does it differ from browser JavaScript?

Explain the roles of V8 and libuv in Node.

What does `process` expose that matters in production services?

When would you choose Node vs a threaded runtime for a backend?

What are Node's module systems today?

Lead: how do you standardize Node runtime versions across a large org?

Describe the Node.js event loop phases at a high level.

What is the difference between `process.nextTick` and `Promise.then` / queueMicrotask?

setTimeout(fn, 0) vs setImmediate(fn) — which runs first?

How can heavy synchronous work break the event loop?

Scenario: API p99 latency jumps but CPU is low. Event loop related?

Lead: how do you teach teams to reason about event-loop safety?

What are Node streams and why use them?

Explain backpressure in Node streams.

pipe vs pipeline — which should you use?

How do you implement a Transform stream?

Debugging: memory grows while streaming a large file upload. Likely causes?

Architecture: design a high-throughput log shipping agent in Node.

What is a Buffer in Node.js?

Buffer.alloc vs Buffer.allocUnsafe vs Buffer.from — security angle?

How do encodings interact with Buffer.toString?

When should you prefer Uint8Array / TypedArrays over Buffer?

Scenario: concatenating many small Buffers in a hot path is slow. Fix?

fs.promises vs fs callbacks vs sync APIs — which in servers?

How do you safely write a file atomically?

What path traversal risks exist with user-provided filenames?

createReadStream vs readFile for large files?

How does the libuv thread pool affect heavy fs workloads?

Lead: design a multi-tenant file storage layer on local disk + S3.

Callbacks, promises, and async/await — how do you choose?

What is the danger of unhandled promise rejections?

Promise.all vs Promise.allSettled vs Promise.race — when?

How do you implement a timeout around an async operation?

Scenario: sequential awaits in a loop make an API slow. Fix?

Explain async context / AsyncLocalStorage use cases.

How does Node resolve `require('pkg')`?

What is the dual package hazard?

ESM top-level await — implications?

How do circular dependencies behave in CJS vs ESM?

When do you use dynamic `import()`?

Lead: monorepo package strategy for Node services?

http.createServer vs frameworks — when is bare http enough?

How do you handle request body parsing safely?

What headers matter for reverse-proxy deployments?

HTTP/2 or HTTP/3 in Node services — practical take?

How do you design idempotent APIs in Node?

Debugging: intermittent 502s from Node behind nginx.

What is Express middleware and how does the chain work?

How do you structure a large Express app?

app.use(express.json()) pitfalls?

Error-handling middleware signature?

Express vs Fastify vs bare http — trade-offs?

Scenario: memory leak in Express after adding session middleware.

Session cookies vs JWT in Node APIs — trade-offs?

How do you store passwords correctly?

Implementing refresh token rotation — key points?

OAuth2 authorization code + PKCE — why for SPAs/mobile?

Where should auth middleware run relative to rate limiting?

Lead: multi-service auth for a Node platform?

What is prototype pollution and how does it show up in Node?

How do you prevent SSRF in a Node URL-fetching feature?

child_process with user input — safe patterns?

Dependency supply-chain hardening for Node?

Helmet and security headers — enough?

Lead: threat model a public Node API gateway.

How do you profile a slow Node service?

When do worker_threads help vs hurt?

JSON.stringify on huge objects in the request path — issue?

Connection pooling best practices for Node DB clients?

What Node flags/metrics help GC tuning conversations?

Lead: define performance budgets for Node microservices.

Vertical vs horizontal scaling for Node apps?

What must be externalized to scale Node horizontally?

How do queues help scale Node workloads?

Caching strategies in Node services?

Scenario: one noisy neighbor tenant saturates a shared Node API.

Lead: capacity plan a Node fleet for Black Friday.

What does the Node `cluster` module do?

cluster vs PM2 vs Kubernetes replicas — how do you choose?

How does sticky session need interact with clustering?

Worker died in cluster — how should the master react?

Lead: is Node cluster still relevant on Kubernetes?

child_process.spawn vs exec vs fork — differences?

How do you gracefully shut down a Node HTTP server?

What is IPC between Node processes used for?

Debugging: zombie/orphan child processes after deploys.

When to use worker_threads vs child_process?

Lead: multi-process architecture for a Node PDF rendering service.

How do you diagnose a Node memory leak?

process.memoryUsage() fields — what do they mean?

Why can Buffer usage grow rss without huge heapUsed?

In-process caches — safe patterns?

Scenario: heap grows only in production under traffic.

Lead: memory SLOs for Node services on K8s.

operational vs programmer errors in Node — why distinguish?

Why is try/catch around an async function call without await ineffective?

Should you catch uncaughtException and keep running?

How do you model errors for APIs?

Express async errors — patterns?

Lead: error budget and incident taxonomy for Node platforms.