Node.js & Express Interview Questions

Node.js is a JavaScript runtime built on Chrome’s V8 engine. It runs JS outside the browser using libuv for async I/O, an event loop, and a thread pool for blocking work. Single-threaded for JS execution, but handles concurrency via non-blocking I/O.

// server.js
const http = require('http');
http.createServer((req, res) => res.end('OK')).listen(3000);

• How does Node differ from browser JS?
• What is libuv?
• Is Node multi-threaded?

• Saying Node is multi-threaded for all JS code
• Confusing Node with Express
• Ignoring the event loop

Explain your API project as: V8 runs your JS, libuv handles sockets and disk I/O.

The event loop processes callbacks in phases: timers, pending callbacks, idle/prepare, poll (I/O), check, close. Microtasks (promises, queueMicrotask) run between phases. Long synchronous CPU work blocks the entire loop.

setTimeout(() => console.log('timer'), 0);
Promise.resolve().then(() => console.log('microtask'));
console.log('sync');
// sync, microtask, timer

• What is the thread pool?
• process.nextTick vs setImmediate?
• How do you avoid blocking the loop?

• Thinking setTimeout(0) runs before promises
• Running heavy JSON parse on every request on main thread
• Using sync fs in production hot paths

If your Express server froze under load, mention checking for sync crypto or large loops on the main thread.

CommonJS uses require/module.exports (default in older Node). ESM uses import/export; enable via .mjs or “type”: “module” in package.json. ESM is static, enables tree-shaking; CJS is dynamic require().

// CommonJS
const fs = require('fs');
module.exports = { read: fs.readFile };

// ESM
import fs from 'fs';
export function read(p) { return fs.promises.readFile(p); }

• Can you require ESM from CJS?
• What is __dirname in ESM?
• Dual package hazard?

• Using import in a .js file without type module
• Mixing default export styles
• Circular requires without refactoring

Match your project’s package.json type field when explaining how you structure routes and models.

npm is Node’s package manager. package.json lists metadata, scripts, dependencies (^semver ranges), and engines. package-lock.json pins exact versions for reproducible installs.

{
  "scripts": { "start": "node server.js", "dev": "nodemon server.js" },
  "dependencies": { "express": "^4.19.0" },
  "devDependencies": { "jest": "^29.0.0" }
}

• npm ci vs npm install?
• What does ^ mean?
• npx?

• Committing node_modules
• Using * for versions in production
• No lockfile in CI

Mention npm run dev and how lockfiles keep teammate machines consistent.

Express is a minimal web framework for Node. It wraps http.createServer with routing, middleware pipeline, and helpers for req/res. Unopinionated — you choose DB, auth, structure.

const express = require('express');
const app = express();
app.get('/health', (req, res) => res.json({ ok: true }));
app.listen(3000);

• Express vs Fastify?
• Is Express still relevant?
• What is app.use?

• Calling app.listen in every route file
• No error handling for async routes
• Huge monolithic app.js forever

Frame your REST API as Express routes + middleware + a data layer.

Middleware functions have (req, res, next). They run in order; call next() to pass control or end the response. Types: application-level, router-level, error-handling (4 args), built-in, third-party.

app.use(express.json());
app.use((req, res, next) => {
  console.log(req.method, req.url);
  next();
});

• What if you forget next()?
• Order of middleware?
• Async middleware errors?

• Mounting auth after routes that need it
• Calling next() after res.send
• Not using error middleware

Describe a logging middleware you added before protected /api routes.

Routes map HTTP methods + paths to handlers. express.Router() groups routes. Path params (:id), optional chaining, and route-specific middleware keep APIs organized.

const router = express.Router();
router.get('/users/:id', (req, res) => {
  res.json({ id: req.params.id });
});
app.use('/api', router);

• Route vs middleware?
• How to handle 404?
• app.all?

• Duplicate route paths with different methods unordered
• No API prefix versioning
• Fat handlers with DB + validation inline

Split users.routes.js and mount at /api/users — interviewers like modular structure.

req carries method, url, headers, query (req.query), body (after parser), params. res sends responses: status(), json(), send(), set headers, cookies. Extended from Node’s http.IncomingMessage/ServerResponse.

app.post('/items', (req, res) => {
  const name = req.body.name;
  res.status(201).json({ name });
});

• req.body without middleware?
• Difference query vs params?
• res.locals?

• Not validating req.body
• Sending 200 for errors
• Leaking stack traces in res.json

Walk through POST /login reading email/password from body and returning JSON tokens.

Use nouns for resources (/users, /users/:id), correct verbs (GET read, POST create, PUT/PATCH update, DELETE remove), consistent JSON, proper status codes, and versioning if needed. Keep handlers thin; delegate to services.

// GET /api/users, POST /api/users, GET /api/users/:id

• REST vs GraphQL?
• When is POST idempotent?
• HATEOAS?

• Verbs in URLs like /getUser
• Using GET to delete
• No pagination on lists

Map your project’s CRUD endpoints to REST verbs and explain why.

Common: 200 OK, 201 Created, 204 No Content, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 409 Conflict, 422 Unprocessable, 429 Too Many Requests, 500 Internal Server Error.

if (!user) return res.status(404).json({ error: 'Not found' });
res.status(201).json(user);

• 401 vs 403?
• When 204?
• 502 vs 503?

• Always 200 with { success: false }
• 500 for validation errors
• 404 for wrong auth

Audit one endpoint and justify each status code you’d return.

Error middleware signature is (err, req, res, next) — four parameters. Place after routes. Sync errors need try/catch or wrappers; async errors must reach next(err) or use express-async-errors / wrapper.

app.use((err, req, res, next) => {
  console.error(err);
  res.status(err.status || 500).json({ error: err.message });
});

• Why 4 args?
• Handling unhandled promise rejections?
• Operational vs programmer errors?

• No error middleware at all
• Sending full err.stack in production
• Forgetting next(err) in async handlers

Show a global handler that logs internally but returns safe messages to clients.

express.json() parses JSON bodies into req.body (built-in since Express 4.16). express.urlencoded() for forms. Set size limits to prevent huge payloads. Raw body needed for webhooks — use verify option.

app.use(express.json({ limit: '100kb' }));

• Content-Type requirements?
• multipart forms?
• Why limit body size?

• Parsing before routes that need raw body
• Trusting req.body without validation
• No limit — DoS risk

Mention validating JSON shape after parsing for your signup endpoint.

CORS is browser-enforced. Server sends Access-Control-Allow-Origin and related headers. Use cors package: cors() for dev, or whitelist origins in production. Preflight OPTIONS for non-simple requests.

const cors = require('cors');
app.use(cors({ origin: 'https://myapp.com', credentials: true }));

• Simple vs preflight?
• credentials with *?
• CORS on server-to-server?

• cors() wide open in production
• Forgetting credentials for cookies
• Only setting CORS on some routes

If React on localhost:5173 hits API on :3000, explain the headers you set.

process.env holds env vars set by the shell, Docker, or hosting platform. Never commit secrets. Use different values per environment (development, staging, production).

const port = process.env.PORT || 3000;

• 12-factor config?
• NODE_ENV?
• Validating env at startup?

• Hardcoding API keys
• No default for PORT locally
• Reading env inside tight loops unnecessarily

Describe PORT and DATABASE_URL coming from Railway/Render/Heroku-style hosting.

dotenv loads .env into process.env at startup. Great for local development. In production, platforms inject env vars — don’t rely on .env files on disk. Add .env to .gitignore.

require('dotenv').config();
const secret = process.env.JWT_SECRET;

• dotenv in production?
• .env.example?
• Multiple env files?

• Committing .env
• Calling config() in every file
• No validation that JWT_SECRET exists

Show .env.example with placeholder keys for contributors.

User logs in; server signs a JWT with a secret/private key containing claims (sub, exp). Client sends Authorization: Bearer . Middleware verifies signature and expiry, attaches user to req.

const token = jwt.sign({ sub: user.id }, process.env.JWT_SECRET, { expiresIn: '1h' });
// middleware: jwt.verify(token, secret)

• JWT vs session cookie?
• Where to store tokens on client?
• Refresh tokens?

• Storing passwords in JWT
• No exp claim
• Using alg none attacks — verify alg

Explain login route issuing JWT and middleware protecting /api/profile.

bcrypt hashes passwords with a salt and adaptive cost factor (rounds). Slow by design to resist brute force. Compare with bcrypt.compare; never store plaintext or reversible encryption.

const hash = await bcrypt.hash(password, 12);
const ok = await bcrypt.compare(password, hash);

• bcrypt vs argon2?
• How many rounds?
• Pepper?

• MD5/SHA for passwords
• Same salt for all users manually wrong
• Logging passwords

Walk through register hashing and login compare in your auth flow.

Sessions: server stores session state (memory/Redis), cookie holds session ID, easier revoke, more server state. JWT: stateless, scales horizontally, harder to revoke instantly, client holds token. SPAs often use JWT + refresh; traditional web apps often sessions.

// session: req.session.userId = user.id
// JWT: Authorization header

• Where to store session store?
• JWT revocation strategies?
• CSRF with cookies?

• JWT in localStorage ignoring XSS risk
• Huge JWT payloads
• Session without secure/httpOnly cookies

Pick what your project uses and defend it with one tradeoff.

MongoDB stores BSON documents. Mongoose adds schemas, validation, middleware, and models. Connect once at startup; use Model.find/create/update with async/await.

const userSchema = new Schema({ email: { type: String, unique: true } });
const User = model('User', userSchema);
const users = await User.find().limit(10);

• Embedded vs referenced docs?
• Indexes?
• Transactions?

• No schema validation
• N+1 populate queries
• Storing unbounded arrays in one doc

Describe one Mongoose model from your project and a typical query.

Use parameterized queries to prevent injection. Tables, primary keys, foreign keys, JOINs. In Node use pg, mysql2, or an ORM (Prisma, Sequelize). Migrations version schema.

const { rows } = await pool.query('SELECT * FROM users WHERE id = $1', [id]);

• ORM vs raw SQL?
• Migrations?
• Indexes for performance?

• String concatenation in SQL
• SELECT * in hot paths
• No connection pooling

Explain a users + orders relationship query you would run from Express.

A pool maintains reusable DB connections. Requests borrow a connection and return it. Limits max connections, reduces handshake overhead. pg Pool and mongoose connection are common patterns.

const pool = new Pool({ max: 20, connectionString: process.env.DATABASE_URL });

• Pool size tuning?
• What happens when pool exhausted?
• Serverless + DB?

• New connection every request
• Never closing pool on shutdown
• One global client with no limits

Mention pool max when discussing deployment under concurrent traffic.

Model: data layer (Mongoose/Prisma). View: often JSON for APIs or templates for SSR. Controller: route handlers orchestrating request/response. Routes wire URLs to controllers.

routes/ → controllers/ → services/ → models/

• Service layer?
• Fat models?
• Where does validation live?

• Business logic only in routes
• Models importing Express
• Circular imports between layers

Draw your folder structure: routes, controllers, models.

Validate body, query, and params with libraries like Zod, Joi, or express-validator. Fail fast with 400/422 and clear messages. Do not trust client input.

const schema = z.object({ email: z.string().email() });
const body = schema.parse(req.body);

• Validation vs sanitization?
• Where to validate — middleware?
• OpenAPI?

• Only frontend validation
• Generic ‘invalid’ errors
• Validating after DB call

Show validating registration fields before creating a user.

Use multer or similar for multipart/form-data. Configure storage (disk, memory, S3). Enforce file size, MIME checks, and auth. Never execute uploaded files.

const upload = multer({ limits: { fileSize: 2 * 1024 * 1024 } });
app.post('/avatar', upload.single('file'), handler);

• Stream to S3?
• Virus scan?
• multipart without multer?

• No size limits
• Trusting client MIME type only
• Serving uploads from same origin without caution

Describe an avatar upload endpoint with size cap.

Streams process data in chunks via Readable, Writable, Duplex, Transform. pipe() connects them. Good for file download/upload, logs, video. Backpressure handled by stream API.

fs.createReadStream('big.csv').pipe(res);

• Backpressure?
• Stream vs buffer entire file?
• HTTP chunked encoding?

• Reading multi-GB file with readFileSync
• Ignoring stream errors
• No timeout on slow clients

Mention streaming a CSV export instead of building one giant string.

cluster forks worker processes sharing a server port. Primary distributes connections; workers run Express. Does not replace horizontal scaling across machines.

if (cluster.isPrimary) {
  for (let i = 0; i < cpus().length; i++) cluster.fork();
} else {
  require('./server');
}

• cluster vs PM2?
• Sticky sessions?
• When not to use cluster?

• Cluster for CPU-heavy JS on one worker misunderstanding
• No process manager in prod
• Shared in-memory state across workers

Note PM2 cluster mode as production alternative.

child_process.spawn/exec/fork runs separate processes. fork() has IPC channel. Use for image processing, ffmpeg, or isolated scripts — not for every request without pooling.

const { spawn } = require('child_process');
const ls = spawn('ls', ['-la']);

• worker_threads vs child_process?
• Security of user input in shell?
• fork IPC?

• exec with unsanitized user input
• Unbounded child spawns
• Ignoring exit codes

Example: spawning a worker script for PDF generation off the hot path.

Buffer is a fixed-length raw binary allocation (Uint8Array under the hood in modern Node). Used with fs, crypto, net. Encoding: utf8, hex, base64.

const buf = Buffer.from('hello', 'utf8');
console.log(buf.toString('hex'));

• Buffer vs TypedArray?
• Why not strings for binary?
• Alloc unsafe?

• Concatenating buffers in a loop inefficiently
• Assuming JSON for binary uploads
• Ignoring encoding

Tie to hashing passwords or reading file headers.

path joins segments safely cross-platform (path.join, resolve, basename). fs reads/writes files; prefer fs.promises or fs/promises over sync APIs in servers.

const filePath = path.join(__dirname, 'data', 'config.json');
const data = await fs.promises.readFile(filePath, 'utf8');

• path.join vs resolve?
• fs streams?
• __dirname in ESM?

• fs.readFileSync in request handler
• Manual string paths with .. bugs
• No error handling for missing files

Loading a JSON config at startup with path.join.

helmet sets HTTP headers (X-Content-Type-Options, CSP helpers, etc.). express-rate-limit caps requests per IP/window to reduce brute force and DoS. Combine with auth, validation, HTTPS.

app.use(helmet());
app.use(rateLimit({ windowMs: 15 * 60 * 1000, max: 100 }));

• Rate limit behind proxy?
• CSP breaking frontend?
• Distributed rate limits?

• Only helmet, no input validation
• Rate limit too loose on /login
• Trust proxy not set on Render/Heroku

List headers helmet adds and rate limit on auth routes.

Use a logger (pino, winston) with levels (info, warn, error). Log request IDs, errors with context, not passwords. In production, ship logs to a aggregator. Morgan complements HTTP access logs.

logger.info({ userId, route }, 'user login');

• Structured vs console.log?
• PII in logs?
• Correlation IDs?

• console.log only
• Logging tokens/passwords
• No log rotation / volume control

Add request id middleware and log failed auth attempts.

Use Jest/Vitest + supertest to hit app without listening on a port. Test status codes, JSON bodies, auth. Mock DB layer for unit tests; integration tests hit real test DB.

const res = await request(app).get('/api/health').expect(200);
expect(res.body.ok).toBe(true);

• Unit vs integration?
• Test databases?
• Coverage goals?

• Only manual Postman
• Tests sharing production DB
• No auth negative tests

Describe one supertest case for a protected route.

Set NODE_ENV=production, use process manager (PM2, Docker, platform). Listen on process.env.PORT. Health endpoint, graceful shutdown on SIGTERM, run migrations separately, monitor errors.

process.on('SIGTERM', () => server.close(() => process.exit(0)));

• Docker multi-stage?
• Zero-downtime deploy?
• Secrets management?

• node server.js in prod without restart policy
• No health check
• Running as root in container

Walk through deploying to Render/Railway/Fly with env vars.

I/O operations are async: callbacks (legacy), Promises, async/await (syntactic sugar). await pauses the function, not the thread. Parallelism with Promise.all for independent tasks.

const [user, posts] = await Promise.all([
  User.findById(id),
  Post.find({ userId: id }),
]);

• Promise.all vs allSettled?
• Sequential await in loops?
• Error handling in async?

• await inside forEach (does not wait)
• Mixing callbacks and promises badly
• Unbounded parallel requests

Refactor callback-style fs to fs.promises in an example.

Deep nested callbacks become unreadable and error-prone. Fix with modular functions, Promises, async/await, and centralized error handling.

// avoid: getUser(id, (e,u) => getPosts(u, (e,p) => ...))
const user = await getUser(id);
const posts = await getPosts(user);

• What is pyramid of doom?
• Error-first callbacks?
• util.promisify?

• Ignoring first err argument in callbacks
• Async await without try/catch
• Creating promise anti-patterns

Show before/after refactoring a nested DB callback chain.

Never interpolate user input into SQL strings. Use placeholders ($1, ?) via pg/mysql2 or ORM. Validate types server-side. Least privilege DB users.

// BAD: `SELECT * FROM users WHERE email = '${email}'`
await pool.query('SELECT * FROM users WHERE email = $1', [email]);

• ORM always safe?
• Second-order injection?
• NoSQL injection?

• Raw SQL with template strings
• Trusting ORM without understanding
• DB user with superuser perms

Audit one query in your project for parameterization.

Stored XSS: malicious scripts saved via API and rendered in a client. Backend should validate/sanitize stored HTML, set Content-Type correctly, encode output in templates, use CSP headers. APIs returning user HTML are risky.

// sanitize before save; JSON APIs usually escape on render in React

• sanitize-html?
• JSON is not auto-safe in innerHTML
• Markdown rendering?

• Storing raw script tags from users
• text/html responses with user content
• No CSP

If your API returns bios rendered on a site, explain sanitization strategy.

Offset/limit (page, pageSize) simple but slow on large offsets. Cursor-based (after=id) scales better for feeds. Return metadata: total or nextCursor, items array.

// GET /users?page=2&limit=20
const users = await User.find().skip((page-1)*limit).limit(limit);

• Keyset pagination?
• Default limits?
• Sorting stability?

• No max limit (limit=999999)
• Inconsistent sort keys
• Offset on million-row tables

Add page/limit query params to your list users endpoint.

Version via URL (/api/v1/users), header (Accept-Version), or query. URL is clearest for many teams. Deprecate old versions with timeline and docs.

app.use('/api/v1', v1Router);
app.use('/api/v2', v2Router);

• Semantic versioning for APIs?
• Backward compatible changes?
• GraphQL versioning?

• Breaking changes without bump
• Two versions diverging same logic duplicated forever
• No deprecation headers

If you only have v1, explain how you’d add v2 for a renamed field.

NODE_ENV commonly ‘development’, ‘test’, or ‘production’. Express enables less verbose errors in production; some libs enable caching. Set explicitly in deployment — not a security boundary alone.

if (process.env.NODE_ENV !== 'production') {
  app.use(morgan('dev'));
}

• Does webpack set it?
• production vs development errors?
• Other env vars?

• Relying on NODE_ENV for auth
• Undefined NODE_ENV in prod
• Different behavior not documented

Toggle detailed error stacks off in production in your error handler.

libuv thread pool (default 4) runs some blocking ops: fs, crypto, dns. Worker threads run JS in parallel for CPU tasks. Event loop stays on main thread per process.

// UV_THREADPOOL_SIZE=8 for more pool threads

• When does DNS use pool?
• crypto.pbkdf2 async?
• worker_threads use case?

• Confusing with cluster workers
• CPU work on main thread
• Huge thread pool without reason

Mention bcrypt async using thread pool under the hood.