Node.js Interview Questions & Answers

A JavaScript runtime, built on Chrome's V8 engine, that lets JavaScript run outside a browser — on a server, as a CLI tool, or in a build script.

Node.js provides server-side APIs like file system and networking access instead of browser APIs like the DOM and window object — the core JavaScript language itself is the same in both.

Single-threaded for executing your JavaScript code, but it delegates I/O work to libuv's thread pool and OS-level async mechanisms, so it can still handle many concurrent operations without blocking.

A CPU-heavy task runs on the single main thread and blocks the event loop, delaying every other request until it finishes — worker threads exist specifically to move CPU-bound work off the main thread.

It records the exact resolved version of every dependency (including nested ones), ensuring consistent installs across machines and CI.

CommonJS uses require() and module.exports; ES Modules use import and export. A file uses one system or the other, not a mix.

By the "type" field in package.json ("module" for ESM, otherwise CommonJS by default), unless the file explicitly uses a .cjs or .mjs extension, which always overrides that setting.

It blocks the entire event loop until the disk read completes, freezing every other in-flight request in the meantime.

They process data in small chunks as it arrives, keeping memory usage low regardless of the total file size.

An automatic mechanism where .pipe() pauses a fast readable stream until a slower writable stream catches up, preventing unbounded memory growth.

Synchronous code runs first, then process.nextTick() callbacks, then resolved Promise (microtask) callbacks, and only then does the event loop reach the timers phase for setTimeout.

To shut down gracefully — finishing in-flight requests and closing database connections — before the process actually exits, which matters especially in containerized deployments.

Routing, middleware, and convenient request/response helpers — none of which exist in the raw http module by default.

Call next() — or send a response directly. Failing to do either leaves the request hanging indefinitely.

Because the express.json() (or similar) middleware was not registered before the route — without it, Express does not parse the body automatically.

By its signature — a function with exactly four parameters: (err, req, res, next).

No — it must be caught and passed explicitly via next(err), or wrapped in a helper that does so automatically (Express 5 changes this behavior).

PUT conventionally replaces the entire resource; PATCH updates only the fields provided in the request.

They prevent SQL injection by safely escaping user-supplied values, instead of concatenating raw input directly into a query string.

Authentication verifies who a user is; authorization determines what an already-authenticated user is allowed to do.

No — it is only base64-encoded and readable by anyone who has the token. The signature only prevents undetected tampering, not reading the contents.

A JWT cannot be instantly revoked before it expires without additional infrastructure, like a token blocklist — unlike a database-backed session, which can be deleted immediately.

bcrypt is deliberately slow and includes an automatic per-user salt, making brute-force attacks impractical — a fast hash function lets attackers try billions of guesses per second.

No — CORS is enforced by browsers for JavaScript-initiated cross-origin requests specifically. It does not stop server-to-server requests, curl, or non-browser clients.

So tests can import the configured Express app directly using a tool like supertest, without needing to start a real server bound to a port.

It can silently fail or, in newer Node.js versions, crash the process entirely — a process.on('unhandledRejection') handler helps surface these bugs during development.