Node.js Senior interview questions and answers

75 questions for a Node.js (Senior) interview - with correct answers, explanations and links to the docs.

Take this quiz
  1. 1.How is the V8 heap organized for garbage collection?
  2. 2.A container has 2 GB of memory, but the Node.js process crashes with 'JavaScript heap out of memory' at about 1.4 GB. What should you check?
  3. 3.Which pattern is a classic cause of a memory leak in a Node.js server?
  4. 4.How do you find what is leaking in a Node.js process?
  5. 5.Why can a closure cause unexpected memory retention?
  6. 6.What are hidden classes (shapes) in V8, and why do they matter?
  7. 7.What does process.memoryUsage() report as rss?
  8. 8.What are WeakRef and FinalizationRegistry NOT good for?
  9. 9.How do you find which functions use the most CPU in production-like conditions?
  10. 10.p99 latency is high but average CPU usage is low. What might be the cause?
  11. 11.What is a typical cause of a slow regular expression blocking a Node.js server (ReDoS)?
  12. 12.Why can JSON.stringify of a large response be a bottleneck, and what helps?
  13. 13.When does increasing UV_THREADPOOL_SIZE actually help?
  14. 14.Why can dns.lookup be a hidden bottleneck for outgoing HTTP calls?
  15. 15.What is a good way to share large binary data between worker threads without copying?
  16. 16.Why should a server use a pool of worker threads instead of creating a new worker per request?
  17. 17.Behind a load balancer (e.g., AWS ALB with a 60 s idle timeout), clients sometimes get 502 errors. What's a common cause?
  18. 18.Why might server.close() not finish during graceful shutdown?
  19. 19.How should a server limit the size of incoming request bodies?
  20. 20.What does server.requestTimeout protect against?
  21. 21.What does HTTP/2 change for a Node.js API used by browsers?
  22. 22.What is undici in Node.js?
  23. 23.What does an async generator in pipeline give you?
  24. 24.What does highWaterMark control?
  25. 25.How do Node.js streams interoperate with Web Streams (ReadableStream)?
  26. 26.Processing an upload stream, you call an async function for each chunk without awaiting it. What's the risk?
  27. 27.What is prototype pollution?
  28. 28.How do you safely serve a user-requested file from an uploads directory?
  29. 29.Your API fetches a URL supplied by the user (e.g. for link previews). What attack must you prevent?
  30. 30.What does the Node.js permission model (--permission) do?
  31. 31.Which measure helps most against malicious package versions (supply-chain attacks)?
  32. 32.Why is eval (or new Function) on user input dangerous even in a 'sandbox' like vm?
  33. 33.Which HTTP-level issue should you protect a Node.js API from besides application bugs?
  34. 34.Why should a Node.js process run as a non-root user in a container?
  35. 35.Why add random jitter to exponential backoff when retrying failed calls?
  36. 36.What does a circuit breaker do?
  37. 37.What problem does the transactional outbox pattern solve?
  38. 38.A message queue delivers messages 'at least once'. What must consumers do?
  39. 39.What is a cache stampede, and how can you prevent it?
  40. 40.Which rate-limiting algorithm allows short bursts while keeping an average rate?
  41. 41.Why should long-running or CPU-heavy work be moved out of the HTTP request path?
  42. 42.How do you keep a slow dependency from taking down the whole service (bulkhead pattern)?
  43. 43.Why might a team choose a modular monolith over microservices for a new Node.js product?
  44. 44.What does OpenTelemetry provide for Node.js services?
  45. 45.Which metrics form the RED method for monitoring a service?
  46. 46.What is diagnostics_channel for?
  47. 47.What is a diagnostic report (--report-on-fatalerror, process.report.writeReport())?
  48. 48.A Node.js process doesn't exit after the main script finishes. What's the usual reason?
  49. 49.Why is uncaughtException + 'log and continue' a bad pattern?
  50. 50.What do module customization hooks (module.register, registerHooks) allow?
  51. 51.What is the 'dual package hazard'?
  52. 52.What is Node-API (N-API)?
  53. 53.What are Single Executable Applications (SEA) in Node.js?
  54. 54.What does the using declaration (explicit resource management) give Node.js code?
  55. 55.How does Node.js handle enum and namespace when running TypeScript with type stripping?
  56. 56.Why does test isolation matter in node --test, and how does it work by default?
  57. 57.What is snapshot startup (--build-snapshot) useful for?
  58. 58.Running Node.js in Kubernetes, should you use the cluster module inside each pod?
  59. 59.Why should a horizontally scaled Node.js service be stateless?
  60. 60.What is the main trade-off of cluster round-robin vs. letting the OS distribute connections?
  61. 61.How do you prevent one tenant or client from exhausting a shared Node.js API?
  62. 62.Your service must call three APIs per request and can tolerate one failing. What approach fits?
  63. 63.How does DataLoader solve the N+1 problem in a GraphQL server?
  64. 64.When is gRPC a good fit compared with REST/JSON?
  65. 65.How do idempotency keys make POST requests safe to retry?
  66. 66.How should you evolve a public API without breaking existing clients?
  67. 67.Why does a Node.js process need a strategy for SIGINT/SIGTERM when it runs as PID 1 in a container?
  68. 68.What is a reasonable way to run scheduled tasks (cron) in a Node.js service with several instances?
  69. 69.Why can AsyncLocalStorage lose its context inside some libraries, and what fixes it?
  70. 70.The client disconnects while your handler runs a slow database query. How do you avoid wasting work?
  71. 71.You scale to 40 instances, each with a pool of 20 connections, and PostgreSQL starts refusing connections. What helps?
  72. 72.Two requests read a record, change it and save it at the same time, and one update is lost. How does optimistic locking prevent this?
  73. 73.What does load shedding mean for an overloaded Node.js service?
  74. 74.How do you deploy a new version of a Node.js API without dropping requests?
  75. 75.A service does heavy image or video processing. Which approach is most sensible in a Node.js stack?