Nodejs
180 bites tagged Nodejs: interview questions with model answers, and 60-second explainers.
Test yourself: Top 30 Nodejs interview questions →Multiple choice, with the correct answer and why it is correct on every question. Free, no sign-in.Critical vm2 sandbox escape (CVSS 10.0) traced to its own README example
GitLab's Threat Research Group found a CVSS 3.1: 10.0 sandbox escape in vm2, a widely used Node.js sandbox library, in a config copied from vm2's own README. Version 3.11.7 fixes the attack, but the underlying risk remains for anyone using require.external. Update immediately and prefer containers for untrusted code.
Diagnosing intermittent crashes with PM2
PM2 auto-restarts and runs cluster mode for availability, inspect logs and metrics, watch memory for leaks, capture errors.
Unit testing Express auth middleware in isolation
Build fake req/res, use a spy/mock for next and res methods, assert next called on valid token and 401 sent on invalid.
JWT login and protected route flow in Express
Verify credentials, sign a JWT, client stores and sends it (Authorization header or httpOnly cookie), middleware verifies signature on protected routes.
Defining many-to-many relationships in Sequelize
Use belongsToMany through a join table, the through table holds the foreign keys, eager-load courses with include.
Nested routes versus query params for related resources
Nested routes express ownership and scope clearly, query params on the flat resource are flexible for filtering and combining.
Callback hell and how to refactor it
Deeply nested callbacks (pyramid of doom) hurt readability and error handling, refactor with promises or async/await.
Blocking versus non-blocking I/O in Node
Blocking calls halt the thread until done, non-blocking returns immediately and notifies via callback or promise, fs.readFileSync versus fs.readFile.
Managing user presence with reconnection grace periods
Rely on heartbeats, apply a grace period before marking offline, reconcile reconnects by user not socket id, use a shared store for multi-instance.
Pinpointing validation errors in nested request data
Use schema validation that reports a path, collect all errors not just the first, return a 400 with field paths and messages.
Purpose of an ORM like Sequelize
Maps rows to objects, gives a model-based API, handles associations, migrations, and parameterized queries across dialects.
Validating request bodies with Express middleware
Run validation middleware before the handler, check email format and password length, return 400 with errors on failure, call next on success.
V8 generational GC and event loop responsiveness
Young-generation scavenges are frequent but short, old-generation major GC is rarer but longer, stop-the-world pauses block the single JS thread.
Detecting and diagnosing event loop lag
Measure delay between scheduled and actual timer fire, expose it as a metric, find synchronous CPU-bound code.
Microtask versus macrotask execution order in Node
NextTick drains before promises, both microtask queues flush fully between each macrotask, timers and setImmediate are macrotasks.
Role of libuv in the Node.js runtime
Libuv provides the event loop, a thread pool for blocking work, and OS async I/O abstractions.
Managing secrets for containerized Node.js on Kubernetes
Use Kubernetes Secrets or an external vault, mount as files not env, encrypt at rest, rotate.
Implementing a custom filtering Transform stream
Subclass Transform with objectMode, implement _transform to parse each chunk, push only matching objects, and call the callback; handle parse errors.
worker_threads versus cluster: when to use each
Worker_threads offloads CPU-bound compute within one process with shared-memory transfer; cluster forks processes to scale IO-bound request throughput across cores.
Offloading CPU work with worker_threads
Heavy sync work blocks the single event loop and stalls all requests; move it to a Worker, message the input, await the result asynchronously, and ideally pool workers.
Purpose of the Node.js cluster module
Cluster forks worker processes sharing one listening port, so requests spread across CPU cores via the OS, raising throughput and adding resilience.
What is a Node.js Stream and why use one
A stream processes data in chunks over time, so memory stays bounded and work starts before all data arrives; ideal for large files and network IO.
JWT storage: localStorage versus HttpOnly cookie
LocalStorage is JS-readable so XSS steals the token; HttpOnly cookies resist XSS theft but reintroduce CSRF, mitigated by SameSite plus CSRF tokens.
Prototype pollution: how it works and prevention
Attacker writes to Object.prototype via __proto__ keys in merge/parse code, poisoning all objects; prevent by guarding keys, null-prototype objects, Object.freeze, Map, and patched deps.
Get Nodejs bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.