Senior Node.js Interview Questions (50 MCQs)

Question 1

Why can a Node server handle 10,000 concurrent TCP connections with a 4-thread pool?

Accepted Answer

Sockets are multiplexed via epoll/kqueue/IOCP on the loop and never occupy the pool

Answer

Each pool thread time-slices 2,500 sockets at once

Answer

Node silently spawns a new OS thread for every connection

Answer

V8 runs connections on its GC helper threads

Question 2

After a spike in outbound requests to many hosts, a service sees odd latency in `fs.readFile`. What's the likely cause?

Accepted Answer

Slow `dns.lookup` calls are hogging every thread in the pool

Answer

Outbound TCP sockets have filled up the thread pool

Answer

The GC is compacting open files on disk

Answer

The event loop created a separate poll phase per host

Question 3

Why might setting `process.env.UV_THREADPOOL_SIZE = 16` mid-application have no effect?

Accepted Answer

The pool is created once on first use, and its size is fixed afterwards

Answer

That variable is only read on Windows

Answer

The value must be a power of two below 8

Answer

Node only reads it from `package.json`

Question 4

What's the best metric for detecting event loop blocking in production?

Accepted Answer

Event loop delay via `perf_hooks.monitorEventLoopDelay` (e.g. p99)

Answer

Overall system CPU usage percentage

Answer

The process's open file count

Answer

The value of `process.memoryUsage().rss`

Question 5

What's the standard technique for finding a memory leak with heap snapshots?

Accepted Answer

Take several snapshots under load, diff them, and inspect retainers of growing objects

Answer

Take one snapshot after restart and look at the largest object

Answer

Call `global.gc()` on each request to clear the leak

Answer

Compare CPU profiles from before and after the deploy

Question 6

Which pattern most likely causes a memory leak in a long-running Node server?

Accepted Answer

A module-level `Map` used as a cache with no size limit or TTL

Answer

Using `const` instead of `let` in handlers

Answer

Defining arrow functions inside each request handler

Answer

Returning Promises from middleware

Question 7

How does V8's generational GC work?

Accepted Answer

Young gen uses fast Scavenges; old gen uses Mark-Sweep-Compact

Answer

Per-object reference counting with no pauses

Answer

The whole heap is cleaned with a single Mark-Sweep every time

Answer

Objects are freed only when the process exits

Question 8

A Node process in a 2 GB container gets OOMKilled without a 'heap out of memory' error. What do you check?

Accepted Answer

Off-heap memory (Buffers, native) and setting `--max-old-space-size` below the limit

Answer

Raising `UV_THREADPOOL_SIZE` to free memory faster

Answer

Changing every `let` to `const` to shrink the heap

Answer

Disabling the GC with `--no-gc` to avoid pauses

Question 9

In `process.memoryUsage()`, `heapUsed` is flat but `rss` keeps climbing. What's the most likely hypothesis?

Accepted Answer

A leak outside the JS heap, such as Buffers or a native addon

Answer

A leak in JavaScript closures stored on the heap

Answer

Too many small strings in the old generation

Answer

Nothing; `rss` always equals `heapUsed`

Question 10

Why can caching `big.subarray(0, 16)` of a 10 MB Buffer cause a memory leak?

Accepted Answer

The subarray is a view onto the same memory, keeping all 10 MB alive

Answer

The subarray makes a new 10 MB copy

Answer

Small Buffers are never garbage collected

Answer

The subarray locks memory on the thread pool

Question 11

Why shouldn't critical logic like closing DB connections rely on `FinalizationRegistry`?

Accepted Answer

Callback timing is non-deterministic and it may never run at all

Answer

`FinalizationRegistry` only exists in browsers

Answer

Its callback runs synchronously as soon as the object leaves scope

Answer

Using it disables the GC entirely

Question 12

`als.getStore()` returns `undefined` inside an old connection-pool library's callback. Likely cause?

Accepted Answer

The library queues callbacks internally and invokes them from another context

Answer

`AsyncLocalStorage` only works with CommonJS

Answer

The store automatically expires after 100ms

Answer

`getStore` only works inside microtasks

Question 13

Why is `AsyncLocalStorage` recommended over raw `async_hooks.createHook` for context propagation?

Accepted Answer

It's a stable, optimized API, while `createHook` is costly and discouraged

Answer

`createHook` only works in worker threads

Answer

`AsyncLocalStorage` persists data to disk

Answer

`createHook` can't track Promises at all

Question 14

An API's p99 latency rose and event loop delay is high. What's the logical next step?

Accepted Answer

Capture a CPU profile (`--cpu-prof` or `--inspect`) and look for hot sync frames

Answer

Take a heap snapshot, since latency is always a memory leak

Answer

Raise `UV_THREADPOOL_SIZE` so JS runs in parallel

Answer

Add `await` in front of every synchronous function

Question 15

What does `clinic doctor` from Clinic.js do?

Accepted Answer

Collects CPU, memory and loop delay under load and suggests the problem class

Answer

Scans dependencies for security vulnerabilities

Answer

Automatically rewrites and optimizes your code

Answer

Runs unit tests in parallel

Question 16

Which Node flag warns whenever synchronous I/O (like `readFileSync`) runs after the first tick?

Accepted Answer

`--trace-sync-io`

Answer

`--no-sync`

Answer

`--trace-gc`

Answer

`--strict-async`

Question 17

A recursive deep-merge merges user JSON into a config object. What does `{"__proto__": {"isAdmin": true}}` do?

Accepted Answer

`isAdmin` lands on `Object.prototype`, so every object inherits it

Answer

It just adds a key named `__proto__` to the config

Answer

`JSON.parse` always rejects such a payload

Answer

It affects only that request and is gone afterwards

Question 18

Which of these is NOT an effective defense against prototype pollution?

Accepted Answer

Calling `Object.freeze` on the final config object after merging

Answer

Rejecting `__proto__`, `constructor` and `prototype` keys during merge

Answer

Using `Map` or `Object.create(null)` for user key-value data

Answer

Running Node with `--disable-proto=delete` and schema-validating input

Question 19

Why is the regex `^(a+)+$` dangerous on user input in Node?

Accepted Answer

Exponential backtracking on input like `'aaaa…a!'` blocks the event loop for ages

Answer

Node runs regexes on the thread pool and exhausts it

Answer

This regex enables SQL injection

Answer

It's harmless, because V8 always runs regexes in linear time

Question 20

Which step most reduces risk from malicious packages with `postinstall` scripts in CI?

Accepted Answer

`npm ci --ignore-scripts` with a committed lockfile, allow-listing only needed scripts

Answer

Running `npm install` with latest versions on every build

Answer

Running `npm audit` after deploying

Answer

Using `^` everywhere so security patches arrive quickly

Question 21

Why compare webhook signatures with `crypto.timingSafeEqual` instead of `===`?

Accepted Answer

`===` exits at the first mismatch, so response timing leaks signature info

Answer

`===` can't compare hex strings

Answer

`timingSafeEqual` is faster because it runs on the thread pool

Answer

`timingSafeEqual` reads the signature from the request header

Question 22

Two worker threads increment a counter in a `SharedArrayBuffer`. Why does `view[0]++` give wrong totals?

Accepted Answer

`++` is a non-atomic read-modify-write; use `Atomics.add` instead

Answer

Each worker gets its own copy of the SharedArrayBuffer

Answer

SharedArrayBuffer is read-only

Answer

Each worker's event loop syncs values lazily

Question 23

How does `postMessage(buf, [buf])` for a 200 MB ArrayBuffer differ from `postMessage(buf)`?

Accepted Answer

Ownership moves without copying, and `buf` becomes detached in the sender

Answer

The data is copied twice so both sides keep a version

Answer

buf turns into a SharedArrayBuffer shared by both threads

Answer

No difference; the second argument is just for debugging

Question 24

When is `child_process` preferable to `worker_threads`?

Accepted Answer

When you need full isolation, e.g. untrusted code or a crash-prone native addon

Answer

When you must share large data between both sides with minimal overhead

Answer

When fast startup and low memory are the top priorities

Answer

When you need `Atomics` and shared memory

Question 25

In Kubernetes, why do teams often run several single-process pods instead of `cluster` inside one pod?

Accepted Answer

The orchestrator handles scaling, health checks and restarts per process more simply

Answer

The `cluster` module doesn't work inside containers

Answer

Kubernetes allows only one thread per pod

Answer

`cluster` shares memory between workers, which is unsafe

Question 26

Code moves data with `readable.on('data', c => slowWritable.write(c))` from a fast source. What happens under load?

Accepted Answer

`write`'s return is ignored, so the Writable's buffer grows until memory runs out

Answer

The Readable auto-pauses because `'data'` handles backpressure

Answer

Excess chunks are silently dropped

Answer

Node throws `ERR_STREAM_BACKPRESSURE`

Question 27

In `await pipeline(src, async function* (source) { for await (const c of source) yield transform(c); }, dest)`, what is the generator's role?

Accepted Answer

A backpressure-aware transform stage without writing a Transform class

Answer

It collects all data first, then sends it to `dest` at once

Answer

It processes chunks on a separate worker thread

Answer

It's only for logging and can't change data

Question 28

After `server.close()` on SIGTERM, the process still won't exit for seconds. Most likely cause?

Accepted Answer

Idle keep-alive connections remain open; use `closeIdleConnections` or a timeout

Answer

`server.close()` only works on HTTPS

Answer

Node always waits 30 seconds before exiting

Answer

The GC must compact the heap before exiting

Question 29

In Kubernetes, why do some requests get 502s during rolling deploys even with graceful shutdown?

Accepted Answer

Endpoint removal races with SIGTERM, so traffic may still arrive briefly after

Answer

Kubernetes always sends SIGKILL before SIGTERM

Answer

Node can never receive SIGTERM inside a container

Answer

The load balancer only routes to pods with an empty heap

Question 30

In Node 15+, what does `const p = fetchUser(); await sleep(1000); try { await p; } catch {}` do if `fetchUser` rejects quickly?

Accepted Answer

It likely crashes, since the rejection is flagged unhandled before a handler attaches

Answer

The `catch` handles it and nothing goes wrong

Answer

`p` stays pending until it's first awaited

Answer

Node buffers the rejection for one second, then passes it to `catch`

Question 31

What is the dual package hazard in a package shipping both CJS and ESM builds?

Accepted Answer

Both builds may load at once, creating two instances with separate state and classes

Answer

Node refuses to load a package that ships two builds

Answer

The ESM build always overwrites the CJS build

Answer

`node_modules` doubles in size and installs slower

Question 32

In recent Node (22.12+) where `require(esm)` is supported, when does requiring an ES Module still fail?

Accepted Answer

When the module graph contains top-level await (`ERR_REQUIRE_ASYNC_MODULE`)

Answer

Always; CommonJS can never load ESM

Answer

Whenever the ESM module has a default export

Answer

Whenever the file extension is `.mjs`

Question 33

Module `counter` exports `let count = 0` and `inc()`. After `inc()`, what is the imported `count` in ESM versus a destructured `count` in CJS?

Accepted Answer

ESM: `1` (live binding); CJS: `0` (value copied at require time)

Answer

Both `1`

Answer

Both `0`

Answer

ESM: `0`; CJS: `1`

Question 34

What is Node's `module.register()` API for?

Accepted Answer

Registering `resolve` and `load` hooks to customize ESM resolution and loading

Answer

Registering a package in the npm registry

Answer

Manually inserting a module into `require.cache`

Answer

Defining aliases for core modules

Question 35

Which Node HTTP server settings mitigate Slowloris attacks (very slow header sending)?

Accepted Answer

`server.headersTimeout` and `server.requestTimeout`

Answer

`UV_THREADPOOL_SIZE` and `--max-old-space-size`

Answer

`server.maxListeners` and `server.highWaterMark`

Answer

`process.setMaxListeners` and `server.unref()`

Question 36

How should operational errors and programmer errors be handled differently in Node?

Accepted Answer

Handle operational errors (e.g. network timeouts) and continue; log bugs and restart

Answer

Catch both with `try/catch` and always continue

Answer

Kill the process immediately for both

Answer

Ignore operational errors and log only bugs

Question 37

Why is the `domain` module not recommended for catching async errors in new code?

Accepted Answer

It's deprecated with design flaws; use Promises, `AsyncLocalStorage` and explicit handling

Answer

It only works on Unix systems

Answer

It was fully removed in Node 12 and importing it throws

Answer

It only catches synchronous errors

Question 38

A metrics library flushes every 10s with `setInterval`, preventing CLI scripts from exiting. What's the proper fix inside the library?

Accepted Answer

Call `.unref()` on the interval so it doesn't keep the process alive

Answer

Replace `setInterval` with a recursive `setImmediate`

Answer

Call `process.exit()` after each metrics flush

Answer

Increase the interval to one hour

Question 39

A query must cancel on either client disconnect or a 10s timeout. What's the cleanest approach?

Accepted Answer

`AbortSignal.any([reqSignal, AbortSignal.timeout(10000)])`

Answer

Passing two separate signals as two `signal` options

Answer

`Promise.race` between the query and a timer, no signal

Answer

`new AbortController({ timeout: 10000 })`

Question 40

In `node:test`, how do you test retry logic with a 30s backoff without real waiting?

Accepted Answer

`mock.timers.enable()` and advance time with `mock.timers.tick(30000)`

Answer

Set `--test-timeout=0` so the test runs faster

Answer

Override `Date.now` alone, which also speeds up `setTimeout`

Answer

Run the test on a worker thread that skips timers

Question 41

Tests pass individually but fail when run together in one process. What's the most likely cause?

Accepted Answer

Shared state in cached modules (singletons, un-restored mocks) leaks between tests

Answer

Node can only run one test file per process

Answer

V8 refuses to JIT consecutive tests

Answer

The thread pool doesn't reset, so files stay locked

Question 42

In Fastify, why isn't a decorator registered inside one plugin visible in a sibling plugin?

Accepted Answer

Each plugin gets an encapsulated context; use `fastify-plugin` to share it

Answer

Decorators activate only after `listen`

Answer

Fastify allows only one decorator per application

Answer

Plugins run on separate worker threads

Question 43

Why do error stack traces through `async/await` usually show callers, while manual callback or `.then` chains often don't?

Accepted Answer

V8 reconstructs 'zero-cost async stack traces' only across `await` frames

Answer

Callbacks run on another thread and have no stack

Answer

Node strips callback stacks for security

Answer

`.then` always runs synchronously and overwrites the stack

Question 44

A login endpoint uses `crypto.pbkdf2Sync` with 600k iterations and overall throughput collapsed. Best fix?

Accepted Answer

Use async `crypto.pbkdf2` (thread pool), tune pool size and add rate limiting

Answer

Drop iterations to 100 to make it faster

Answer

Wrap `pbkdf2Sync` inside `Promise.resolve().then`

Answer

Cache hashes in memory keyed by plaintext password

Question 45

In Docker, why might `CMD npm start` cause a Node app's `SIGTERM` handler to never run?

Accepted Answer

npm or a shell as PID 1 may not forward the signal to the child Node process

Answer

Docker only sends signals to Python processes

Answer

`npm start` converts every signal into `SIGKILL`

Answer

Node doesn't support signals inside containers

Question 46

A report endpoint loads 500k DB rows and sends them with `res.json(rows)`. Memory and latency spike. Best redesign?

Accepted Answer

Read via a cursor and stream output (e.g. NDJSON) through `pipeline` with backpressure

Answer

Raise `--max-old-space-size` until the data fits

Answer

Run `JSON.stringify` inside `setImmediate`

Answer

Synchronously gzip the response before sending

Question 47

In an ESM file (`.mjs`), what does `process.nextTick(() => console.log('n')); Promise.resolve().then(() => console.log('p')); console.log('s');` print?

Accepted Answer

`s p n`

Answer

`s n p`

Answer

`n p s`

Answer

`p s n`

Question 48

Why can `delete obj.prop` in a hot path noticeably slow code down?

Accepted Answer

It moves the object from a fast hidden class to dictionary mode, defeating inline caches

Answer

`delete` triggers an immediate synchronous full GC

Answer

`delete` removes the property from every instance of the class

Answer

`delete` runs on the thread pool and waits in its queue

Question 49

Why is running `node --inspect=0.0.0.0:9229` on a production server dangerous?

Accepted Answer

Anyone who can reach the port can execute arbitrary code inside the process

Answer

The inspector is read-only and only costs a little CPU

Answer

The inspector stops all logs from reaching stdout

Answer

It forces the process to wait for a debugger before starting

Question 50

A service creates a `new Worker(...)` per request and sees high latency and memory. Best fix?

Accepted Answer

Use a fixed-size worker pool (e.g. piscina) and dispatch tasks to it

Answer

Create workers with `eval: true` so they load faster

Answer

Raise `UV_THREADPOOL_SIZE` so workers run inside it

Answer

Replace workers with `setImmediate` on the main thread