Question 1

How do you detect and profile memory leaks in Node.js servers?

Accepted Answer

Memory leaks in Node.js typically occur when global variables, event listeners, or cache objects retain references to dead objects. Start Node with inspect flags: `node --inspect index.js`. Connect Chrome DevTools to the Node process, take Heap Snapshots under the Memory tab, and compare snapshots before and after sending mock traffic using load testers (like autocannon) to identify growing constructor instance counts.

Question 2

What are Worker Threads in Node.js and when should you use them?

Accepted Answer

Worker Threads (`worker_threads` module) allow you to run CPU-intensive tasks (like image processing, cryptography, or heavy mathematical calculations) in background threads, sharing memory using `SharedArrayBuffer`. Use them when tasks would block the main single thread, as blocking the main thread degrades response times for all incoming HTTP requests.

Question 3

Explain the cluster module in Node.js and how it implements scaling.

Accepted Answer

The `cluster` module lets you spawn multiple instances of your Node.js application, sharing the same server port. It spawns worker processes using `child_process.fork`. The master process acts as a load balancer, distributing incoming connections to workers using a Round-Robin algorithm, maximizing CPU usage on multi-core servers.

Question 4

How do you write unit tests for Node.js API endpoints using Supertest?

Accepted Answer

Supertest wraps your Express or NestJS app instance, allowing you to trigger mock HTTP requests without starting a live network server. You assert responses using promise chains:
```javascript
const request = require('supertest');
const app = require('./app');

test('GET /api/users', async () => {
  const res = await request(app)
    .get('/api/users')
    .expect('Content-Type', /json/)
    .expect(200);
  expect(res.body.users).toBeDefined();
});
```

Question 5

Explain how to secure Node.js APIs against Brute Force attacks.

Accepted Answer

Implement rate-limiting middleware (like `express-rate-limit` or Redis-based limiters). Track client IP addresses and limit the number of requests they can make within a time window (e.g. 100 requests every 15 minutes), returning a 429 status code if exceeded.

Question 6

Explain the difference between event-driven architecture and thread pool architecture.

Accepted Answer

Event-driven architecture uses a single thread to handle loop triggers and delegate tasks, maintaining low memory footprints. Thread pool architecture (like Apache) spawns dedicated OS threads per connection, which can run out of memory under high concurrent loads.

Question 7

How does the libuv thread pool function under the hood?

Accepted Answer

libuv is the C library that handles Node's async tasks. While network I/O is handled natively by the OS kernel, file system operations, cryptography (`crypto`), and compression (`zlib`) are execution-blocked, so libuv executes them in its default thread pool (size 4, configurable via `UV_THREADPOOL_SIZE`).

Question 8

How do you write integration tests for database models in Node?

Accepted Answer

Use test databases (like memory databases or test MongoDB containers). In test setup phases (`beforeAll`), run migrations and seed data. Execute model actions, assert updates in the test database, and clear states in `afterAll` checks.

Question 9

Explain the role of Node.js Streams piping.

Accepted Answer

Piping (`readable.pipe(writable)`) connects readable streams to writable targets. It manages backpressure automatically: if the writable target is busy, the pipeline pauses the readable source, preventing memory overflows.

Question 10

What is event-loop block time and how do you monitor it?

Accepted Answer

Event-loop block time is the duration the main thread is blocked by synchronous tasks, delaying async callbacks. Monitor it using libraries like `blocked-at` or performance hook APIs (`perf_hooks`) to trace slow execution lines.

Question 11

Explain how to implement JSON Web Token (JWT) auth in Express middleware.

Accepted Answer

Write a middleware function that extracts the token from the `Authorization` header (`Bearer <token>`). Verify the signature using `jwt.verify(token, secret)`. If valid, attach the user payload to the request object and call `next()`; otherwise, return a 401 response.

Question 12

How do you write unit tests for modules that depend on fs?

Accepted Answer

Mock the file system module. In Jest, use `jest.mock('fs')` to mock file read and write operations, or use mock FS utilities (like `memfs`) to write files inside an in-memory virtual volume during tests.

Question 13

What is the purpose of the VM module in Node.js?

Accepted Answer

The `vm` module lets you compile and run JavaScript code inside V8 virtual machine contexts. It is useful for running untrusted user scripts in isolated sandbox environments, though it has security vulnerabilities.

Question 14

Explain the differences between http.createServer and https.createServer.

Accepted Answer

`http` handles unencrypted traffic over port 80. `https` handles encrypted traffic over port 443, requiring SSL/TLS certificate options (private key and certificate files) during server creation.

Question 15

How do you trace slow network connections inside Node.js applications?

Accepted Answer

Use Node's tracing module (`node --trace-events-enabled`). This outputs chrome tracing log files. Import logs into browser performance profile checkers to analyze socket open times and handler delays.

Question 16

What is the purpose of process.send() and IPC channels?

Accepted Answer

IPC (Inter-Process Communication) channels allow parent and child processes (spawned via `fork`) to communicate. Use `process.send({ msg: 'data' })` to pass serialized JSON payloads across processes.

Question 17

How do you verify test assertions for rejected promises?

Accepted Answer

In Jest, write async tests and assert failures using rejects: `await expect(asyncAction()).rejects.toThrow('Error')`. This ensures that promise rejections are verified correctly.

Question 18

Explain the V8 memory spaces (Young Generation, Old Generation, Large Object Space) and how to debug Heap Out of Memory errors.

Accepted Answer

V8 manages memory by dividing the Heap into spaces:
1. New Space (Young Generation): Small area (1-64MB) where allocations occur. Collected frequently using a fast Scavenge algorithm.
2. Old Space (Old Generation): Large area where surviving objects are promoted. Collected less frequently using Mark-Sweep-Compact.
3. Large Object Space: Used for objects larger than page sizes, bypassing normal GC sweeps.

Heap Out of Memory (OOM) errors occur when Node exceeds the memory limit (defaults to ~1.4GB on 64-bit systems). Debug this by starting Node with inspect tools, triggering heap dumps on crashes using `--write-heapprof-on-fatal-error`, and analyzing memory leak sources in Chrome DevTools. Increase limits using `--max-old-space-size=4096`.

Question 19

Explain how to build highly scalable websocket applications in Node.js with clustering and Redis adapter scaling.

Accepted Answer

WebSockets maintain persistent connections, meaning clustering creates issues since clients connected to server A cannot receive messages emitted by server B. To scale:
1. Spawning workers: Cluster Node instances using PM2 or the `cluster` module.
2. Redis Adapter: Integrate a Redis pub/sub adapter (like `socket.io-redis`). When server A emits an event, it publishes the event to Redis. Redis broadcasts the payload to all clustered server nodes, which transmit the message to their connected clients.
3. Load Balancing: Configure sticky sessions on load balancers (like Nginx) to route socket handshake requests to the same worker instance.

Question 20

How do you manage distributed logging and request correlation inside Node.js microservices?

Accepted Answer

Implement request correlation by injecting a unique correlation ID header (e.g. `X-Correlation-ID`) at the API Gateway level. Inside Node.js microservices, use OpenTelemetry with `AsyncLocalStorage` to store the correlation ID. Every database query or HTTP request to downstream services reads the ID from local storage and forwards it, allowing logs to be traced across all services.

Question 21

Explain security configurations of Node.js servers, focusing on CSRF, XSS, and SQL Injection mitigations.

Accepted Answer

Secure Node applications by:
1. Helmet: Use Helmet middleware to set secure HTTP headers (CSP, HSTS, X-Frame-Options).
2. CSRF: Store sessions in HttpOnly cookies, and require anti-CSRF tokens for mutating actions.
3. SQL Injection: Use parameterized queries or ORMs (like Prisma/Mongoose) to escape inputs, preventing attackers from injecting arbitrary DB queries.

Question 22

Explain how to handle CPU-bound tasks in Node.js without blocking the single-threaded event loop.

Accepted Answer

Do not execute CPU-bound tasks (like PDF parsing or zip compression) on the main event thread. Offload tasks by:
- Spawning Worker Threads (`worker_threads` module) to run JS code in background threads.
- Creating Child Processes (`child_process` module) to run external command tasks.
- Delegating tasks to external background queues (like BullMQ) backed by worker processes.

Question 23

Explain the architecture of Node.js stream buffering and watermarks.

Accepted Answer

Node streams buffer data in chunks. The `highWaterMark` option sets the buffer threshold (e.g. 16KB for readable streams). If the internal buffer is filled, the stream pauses loading data until it is read.

Question 24

How do you set up distributed tracing inside Node.js applications?

Accepted Answer

Install OpenTelemetry modules. Initialize tracing early in the entrypoint file to patch core packages (like `http`, `mongodb`, `redis`). Trace contexts are passed across requests using W3C Trace Context headers.

Question 25

Explain how to debug CPU bottlenecks inside Node.js production servers.

Accepted Answer

Capture CPU profiles. Run Node with `--cpu-prof`, or use APM tools to capture profiles under load. Import profiles into Chrome DevTools to locate slow synchronous JS code blocks.

Question 26

How does Node.js resolve circular dependencies and what are the runtime risks?

Accepted Answer

If module A requires module B, and B requires A, Node returns an unfinished copy of A's exports object to B to prevent infinite recursion, which can cause runtime crashes where imported functions evaluate to `undefined`.

Question 27

How do you optimize Node.js TLS context loading in high-traffic applications?

Accepted Answer

TLS handshake is CPU-intensive. Optimize by configuring SSL termination at the reverse proxy level (Nginx, Cloudflare), offloading encryption tasks from the Node server process entirely.

Question 28

Explain the differences between child_process exec and spawn.

Accepted Answer

- `exec()` buffers the entire command output in memory before returning it, which can crash if the output exceeds limits.
- `spawn()` streams output in real-time via stdout/stderr, utilizing less memory.

Question 29

How do you build a secure sandbox runner inside Node.js?

Accepted Answer

Use isolated sandboxing frameworks (like VM2 or isolated-vm). Run execution code in a separate OS thread or container with strict resource limits, disabling access to native modules (like `fs` or `net`).

Question 30

How does Node.js manage memory heap garbage collection statistics?

Accepted Answer

V8 publishes GC statistics using the `perf_hooks` module. Connect event listeners to trace garbage collection events, monitoring how much memory is recovered on sweeps to detect leaks.

Question 31

Explain how to write custom streams in Node.js.

Accepted Answer

Extend stream classes (e.g. `Readable`, `Writable`) and implement internal methods (like `_read()` or `_write()`), managing callback execution and backpressure triggers.

Question 32

How do you audit memory leak allocations inside production containers?

Accepted Answer

Start the Node container process with inspect flags. Port-forward the inspection port locally via SSH tunnels (`ssh -L 9229:localhost:9229 container-ip`), and attach Chrome DevTools to profile the process.

Question 33

Explain performance trade-offs of using AsyncLocalStorage in Node.

Accepted Answer

`AsyncLocalStorage` runs context tracking using V8 promise hooks. While useful for storing correlation IDs, it adds tracing overhead to async operations, which can degrade throughput slightly in high-QPS APIs.

Question 34

How do you implement secure rate-limiting on WebSocket handshakes?

Accepted Answer

WebSocket upgrades begin with standard HTTP GET requests. Intercept this upgrade request in Nginx or Express middleware, checking the client IP address in Redis before upgrading the connection.

Senior Node.js Interview Questions (5+ Years Experience) (2026)

What is Node.js and Why is it Critical in Modern Engineering?

Node.js Lifecycle Visualizer

Core Architectural Concepts in Node.js

V8 Engine Compilations

Event Loop Microtasks

Buffer & Stream Inputs

File System Operations

Cluster & Worker Threads

check_circleWhy Modern Companies Choose Node.js

lightbulbStrategic Preparation Tips

errorCrucial Mistakes to Avoid

trending_upHiring Trends & Career Outlook (2026)

Performance