Node.js interviews revolve around the event loop, asynchronous patterns, Express or NestJS, and the consequences of a single-threaded runtime. Below are the most common questions with model answers. Senior: architecture, trade-offs, mentoring, and decision-making.
You wrap awaited calls in try/catch, or attach .catch to the returned promise. In Express, an error thrown inside an async handler is not caught by the framework unless you forward it to next(), so most teams use a wrapper or express-async-errors. An unhandled rejection terminates the process by default in modern Node, which is intentional — the process is in an unknown state and should be restarted.
Streams process data in chunks, so memory usage stays constant regardless of payload size and the first byte can be sent before the last is read. Reading a two-gigabyte file into a Buffer exhausts memory and delays the response; piping it streams straight to the client. Streams also compose through pipe or pipeline, letting you chain decompression, transformation, and output with backpressure handled for you.
Middleware is a function receiving request, response, and next, executed in registration order to form a pipeline. Calling next() hands control to the next middleware; not calling it and not sending a response leaves the request hanging. Passing an argument to next() skips ahead to error-handling middleware, which is recognised by having four parameters.
Because JavaScript runs on one thread, a CPU-heavy computation blocks every pending request. Worker threads run JavaScript in parallel threads within the same process, communicating by message passing and shared array buffers, which suits hashing, image processing, or parsing. The alternatives are offloading to a separate service or a job queue — clustering only adds processes and does not make a single request faster.
A JWT is a signed token carrying claims, so the server can authenticate a request without a session lookup. Storing it in localStorage exposes it to XSS; storing it in an httpOnly, Secure, SameSite cookie protects against XSS but requires CSRF defence. The deeper trade-off is revocation: a stateless token stays valid until it expires, so sensitive systems use short-lived access tokens with refresh tokens and a server-side denylist.
CommonJS require is synchronous, resolved at runtime, and can be called conditionally inside a function. ESM import is static, hoisted, and analysed before execution, which enables tree shaking and top-level await. A package declares its format with "type": "module" or the .mjs and .cjs extensions; ESM can import CommonJS, but the reverse needs a dynamic import() because require cannot load an async module graph.
On SIGTERM you stop accepting new connections with server.close(), let in-flight requests finish, then close database pools, message consumers, and timers before exiting. A timeout forces exit if something hangs, so the container is never stuck. Without this, a deploy kills requests mid-flight and can leave transactions or queue messages in an inconsistent state.
In a real interview you speak under pressure. Cam asks these same questions, scores every answer, and shows exactly what to fix.
Practice a Senior Node.js Backend interview →