Node.js interview questions and answers

1. Installing a test-only package

You want to add Vitest to a project. It is only needed during development and testing, not in production code. Which command is correct?

1. A.npm install --global vitest
2. B.npm install -D vitest
3. C.npm run vitest
4. D.npm install --save-exact --prod vitest

2. What ~2.4.1 allows

In package.json, which versions does "~2.4.1" accept?

1. A.2.4.1 up to, not including, 3.0.0
2. B.Only exactly version 2.4.1
3. C.2.4.1 up to, not including, 2.5.0
4. D.Any version at all from 2.0.0

3. npm ci in pipelines

Why use npm ci instead of npm install in a CI pipeline?

1. A.It installs exactly what the lockfile says, from clean
2. B.It updates every package to the newest version
3. C.It skips installing all devDependencies
4. D.It works without a package.json file

4. Committing the lockfile

Should package-lock.json be committed to Git for an application?

1. A.No, it is a temporary file made by npm
2. B.Only on the main branch, not on others
3. C.Only when the app has no dependencies
4. D.Yes, so every install gets the same versions

5. What npx does

What does running npx create-vite my-app do?

1. A.Adds create-vite to the project dependencies
2. B.Publishes my-app to the npm registry
3. C.Updates npm itself to the latest version
4. D.Runs the package's command, downloading it if needed

6. What a 504 from Nginx means

Users see "504 Gateway Timeout" from Nginx, which sits in front of your Node.js app. What does it tell you?

1. A.The client sent a malformed request
2. B.The TLS certificate on the proxy has expired, so Nginx refuses to forward the request to the app
3. C.The client is not authenticated
4. D.Nginx did not receive a response from the upstream app server in time

7. Promise and setTimeout order

What does this Node.js code print?

console.log('A')
setTimeout(() => console.log('B'), 0)
Promise.resolve().then(() => console.log('C'))
console.log('D')

1. A.A B C D
2. B.A D B C
3. C.A C D B
4. D.A D C B

8. setTimeout as a job queue

A Node.js API schedules follow-up emails with setTimeout(sendEmail, 24 * 3600 * 1000). What is the main problem?

1. A.setTimeout cannot hold delays longer than an hour
2. B.The email will be sent once per CPU core
3. C.It blocks the event loop for 24 hours
4. D.Pending emails are lost when the process restarts

9. Cost of Array.shift in a queue

A Node.js worker uses an array as a queue with push() to add and shift() to remove. With 100,000 items waiting, why can this get slow?

1. A.shift() re-indexes every remaining item, O(n)
2. B.push() copies the whole array on each call
3. C.Arrays cannot hold more than 65,535 items
4. D.shift() sorts the array before it removes

10. Empty req.body in Express

The server uses express.json(), but req.body is empty when this request arrives. What is the simplest fix on the client?

await fetch('/api/todos', {
  method: 'POST',
  body: JSON.stringify({ title: 'Buy milk' }),
})

// server
app.use(express.json())
app.post('/api/todos', (req, res) => {
  console.log(req.body) // empty, no title
})

1. A.Change the method from POST to PUT
2. B.Send the body as FormData instead of a string
3. C.Add headers: { 'Content-Type': 'application/json' } to the fetch call
4. D.Call JSON.stringify twice so the body is still valid JSON after the server parses it once

11. try/catch around an async call

Running this in Node.js, what happens?

async function load() {
  throw new Error('boom')
}

try {
  load()
} catch (e) {
  console.log('caught')
}
console.log('done')

1. A.'caught' then 'done'
2. B.'caught' only
3. C.'done', then the process reports an unhandled rejection
4. D.Nothing is printed, because the rejected promise is silently ignored

12. Generating a reset token

Which is the right way to make an unguessable reset token in Node.js?

1. A.crypto.randomBytes(32).toString('hex')
2. B.Math.random().toString(36).slice(2)
3. C.Date.now().toString(16) + user.id
4. D.md5(user.email + 'reset')

13. Speeding up mobile CI builds

A CI pipeline for a cross-platform app spends 12 minutes downloading Gradle, CocoaPods and npm or pub packages on each run. What is the first thing to try?

1. A.Cache dependency folders keyed on the lock files
2. B.Run the build twice so the second run is faster
3. C.Delete the lock files so resolution is quicker
4. D.Build only on Fridays to save CI minutes

14. A YAML-based load tool

Which open-source load tool describes phases and scenarios mainly in YAML files and runs on Node.js?

1. A.Artillery
2. B.JMeter
3. C.Locust
4. D.Gatling

15. __dirname in an ES module

A Node.js script was converted to ESM ("type": "module"). It now fails with "__dirname is not defined". What is the modern fix?

1. A.Call require("path").dirname() with no arguments
2. B.Use import.meta.dirname (or derive it from import.meta.url)
3. C.Declare var __dirname = "." at the top of the file
4. D.Rename the file to .ts so Node adds __dirname

16. Two copies of one library

The bundle analyzer shows two copies of date-fns, versions 2.x and 3.x. What is the likely cause?

1. A.The bundler copies every package twice
2. B.The lockfile was committed to Git
3. C.date-fns is listed in devDependencies
4. D.Different packages depend on incompatible ranges

17. Finding why a package is installed

Which command shows which dependency pulled a package into node_modules?

1. A.npm audit lodash
2. B.npm explain lodash
3. C.npm outdated lodash
4. D.npm pack lodash

18. Does devDependencies keep code out?

A library is in devDependencies but is imported in a frontend component. Will it be in the production bundle?

1. A.No; devDependencies are always left out
2. B.Only if NODE_ENV is set to development
3. C.Only if the library has no default export
4. D.Yes; the bundler includes whatever the code imports

19. A 64-bit id changes after parsing

An upstream service sends a 64-bit numeric id. What does this Node.js code print?

const body = '{"id": 9007199254740993}'
console.log(JSON.parse(body).id)

1. A.9007199254740993
2. B.9007199254740992
3. C."9007199254740993"
4. D.SyntaxError: number too large

20. Webhook signature never matches

You verify a payment provider's webhook signature like this, using the correct secret, but verification always fails. Why?

app.post('/webhooks/pay', express.json(), (req, res) => {
  const expected = crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(JSON.stringify(req.body))
    .digest('hex')
  if (expected !== req.get('X-Signature')) return res.sendStatus(400)
  // ...
})

1. A.The signature covers the exact raw request bytes, and re-serialising the parsed JSON changes them
2. B.HMAC-SHA256 cannot be computed with Node.js crypto
3. C.The secret must be base64-decoded twice before use
4. D.The HMAC must be computed over the object with sorted keys, so the code should sort req.body keys before stringifying

21. Pool runs dry after some errors

After a few failed queries, every request hangs waiting for a database connection. What is the bug?

const client = await pool.connect()
const res = await client.query(sql, params)
client.release()
return res.rows

1. A.The pool must be created inside each request
2. B.client.release must be called before the query
3. C.If query throws, release never runs; put it in finally
4. D.pool.connect returns a new database every time

22. Algorithm behind Python and V8 sort

Which algorithm do CPython's list.sort() and the V8 engine's Array.prototype.sort (Chrome, Node.js) use?

1. A.Timsort, a stable merge and insertion sort hybrid
2. B.Introsort, an unstable quick and heap sort hybrid
3. C.Plain heap sort, for its O(1) memory
4. D.Randomised quick sort with three-way partitioning

23. Promise callback versus setTimeout order

In Node.js or a browser, what does this code print?

console.log(1)
setTimeout(() => console.log(2), 0)
Promise.resolve().then(() => console.log(3))
console.log(4)

1. A.1 4 3 2
2. B.1 2 3 4
3. C.1 4 2 3
4. D.1 3 4 2

24. Webhook signature always fails

Stripe webhook verification fails for every event, even though the signing secret is correct. The app registers app.use(express.json()) before all routes. What is the cause?

1. A.Stripe webhooks must be received over plain HTTP, because TLS changes the signed payload
2. B.The signature covers the raw bytes, which parsing and re-serializing change
3. C.Webhook secrets expire every hour
4. D.Express cannot read headers on POST requests

25. One report slows every request

An Express API has a route that builds a large report in a synchronous loop taking 3 seconds. While it runs, even the health check times out. Why?

1. A.Express handles only one route per file
2. B.The database connection pool is too small
3. C.Node runs JavaScript on one main thread, so the loop blocks the event loop for everyone
4. D.The health check route is missing async

26. Matrix jobs cancelled early

A workflow tests on Node 20, 22 and 24 using a matrix. When the Node 20 job fails, the other two are cancelled, hiding whether they pass. Why?

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node: [20, 22, 24]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: "${{ matrix.node }}" }
      - run: npm ci && npm test

1. A.All matrix jobs share one runner, so one failure stops the whole runner.
2. B.actions/setup-node cancels the other Node versions when one of them fails.
3. C.fail-fast defaults to true, cancelling the other matrix jobs; set fail-fast: false.
4. D.You must add needs: between matrix entries so they run independently.

27. Merge conflict in package-lock.json

Two branches both added npm packages, and merging them gives a large conflict in package-lock.json. What is the cleanest way to resolve it?

1. A.Delete the lockfile and stop committing it to Git
2. B.Fix package.json, then rerun npm install to rebuild it
3. C.Pick all of one side's lockfile changes by hand
4. D.Mark the lockfile as a binary file in .gitattributes

28. Focusing audit on shipped code

`npm audit` lists 80 issues, most in build and test tools that never ship. You want a gate that focuses on code that runs in production. What helps?

1. A.Delete the lockfile so npm audit finds fewer packages
2. B.Run npm audit --omit=dev for the gate, and track dev issues apart
3. C.Turn off npm audit in CI
4. D.Move all dev dependencies into dependencies

29. Comparator that returns a boolean

What does this print in Chrome or Node.js?

console.log([3, 1, 2].sort((a, b) => a > b))

1. A.[3, 1, 2]
2. B.[1, 2, 3]
3. C.[3, 2, 1]
4. D.A TypeError, because the comparator must return a number

30. Deep import breaks after upgrade

After upgrading a library, import 'lib/dist/utils.js' fails with ERR_PACKAGE_PATH_NOT_EXPORTED. Why?

1. A.The file was converted from JavaScript to TypeScript
2. B.Its new "exports" map hides that internal path
3. C.npm now blocks every import from a dist folder
4. D.Node.js dropped support for the .js file extension

31. Build fails after moving to pnpm

After switching from npm to pnpm, a build fails because the code imports a package it never declared. Why does pnpm expose this?

1. A.pnpm deletes all transitive dependencies
2. B.pnpm does not support importing packages
3. C.pnpm only links declared dependencies into node_modules
4. D.pnpm installs only devDependencies by default

32. Connection resets when pods stop

Kubernetes sends SIGTERM to old pods during a deploy, and some in-flight requests fail with connection resets. What should the Node.js app do on SIGTERM?

1. A.Call process.exit(0) at once to exit cleanly
2. B.Ignore SIGTERM and wait for SIGKILL to arrive
3. C.Stop new connections, finish current ones, then exit
4. D.Restart the HTTP server on a different port

33. A CSV export runs out of memory

An endpoint builds a CSV of 5 million rows as one string and then calls res.send. The process runs out of memory. What is the better design?

1. A.Stream rows to the response with backpressure
2. B.Raise the Node.js heap size limit to 16 GB
3. C.Gzip the whole string before sending it
4. D.Send the same data as JSON instead of CSV

34. Consumer runs out of memory

A Node.js consumer pulls messages as fast as the broker sends them and starts a promise for each. During a backlog it uses 6 GB and crashes. What is the fix?

1. A.Limit in-flight messages with prefetch and a concurrency cap
2. B.Give the container 12 GB of memory
3. C.Ack each message before starting its promise
4. D.Switch to auto-ack so messages leave the broker

35. Backpressure in Node.js streams

A Node.js script reads a 10 GB file and calls writable.write(chunk) for every chunk, ignoring the return value. Memory grows to several GB. What is wrong?

1. A.write() returned false; wait for "drain"
2. B.Streams must be closed after each chunk
3. C.The file is too large for the fs module
4. D.write() is asynchronous and needs await

36. Chat across many servers

A chat app runs 3 Node.js instances behind a load balancer. Users on different instances do not receive each other's messages. What is the standard fix?

1. A.Add a pub/sub backplane such as Redis Pub/Sub or NATS so each instance publishes messages and all instances deliver them to their own connected sockets
2. B.Run only one instance forever
3. C.Make every client poll every instance directly
4. D.Store messages in each instance memory and copy them with a cron job

37. Comparing secret tokens safely

A webhook endpoint checks if (provided === process.env.API_KEY). You want to remove the timing side channel. Which approach is correct in Node.js?

1. A.Keep === and add a random sleep after each check
2. B.Hash both values (e.g. SHA-256) and compare the digests with crypto.timingSafeEqual
3. C.Call crypto.timingSafeEqual on the raw strings; it returns false if the lengths differ
4. D.Convert both strings to lowercase before comparing

38. Async error skips Express handler

This app runs Express 4 on Node 22, and loadReport() rejects. What happens?

app.get('/report', async (req, res) => {
  const data = await loadReport()
  res.json(data)
})

app.use((err, req, res, next) => {
  res.status(500).json({ error: 'Something went wrong' })
})

1. A.The error middleware catches the rejected promise and returns the 500 JSON response as written
2. B.Express retries the handler once
3. C.The error middleware is skipped; the rejection goes unhandled and crashes the process
4. D.The client receives an empty 200 response

39. Deleted secret still in the image

This Dockerfile copies an npm token, uses it, then deletes it. A scan still finds the token in the pushed image. What is the right fix?

FROM node:22-alpine
WORKDIR /app
COPY .npmrc package*.json ./
RUN npm ci
RUN rm .npmrc
COPY . .

1. A.Run rm .npmrc in the same RUN line as npm ci, which removes it from every layer of the image.
2. B.Pass the token with ARG NPM_TOKEN instead, because build args are never stored in the image.
3. C.Squash the image after pushing it, so the registry drops the older layer that holds the file.
4. D.Use a BuildKit secret mount (RUN --mount=type=secret,id=npmrc ...) so the token never lands in a layer.

40. Same commit, different build result

Rebuilding last month's commit now fails, though no code changed. The Dockerfile uses FROM node:20 and the build runs `npm install` without a lockfile. What is the root problem?

1. A.The CI runner clock is set to a different time zone
2. B.Docker images expire after 30 days in the registry
3. C.Git commits change their content after a month
4. D.Unpinned inputs: the base image and packages changed since then

41. A Node.js API stalls under load

A Node.js API has one endpoint that hashes passwords with a synchronous function taking 150 ms. Under load, every endpoint becomes slow, even simple health checks. Why?

1. A.Synchronous work blocks the single event loop for all requests
2. B.Node.js can only accept one TCP connection at a time
3. C.Health checks always slow down under any kind of load
4. D.The hashing endpoint is using too little memory to run