Node.js Interview Questions and Answers for Intermediate 2026

21. What is fork in Node.js?

In Node.js, fork() is a method of the child process module used to create a new Node.js process.

Key points:

• Specifically used to run another Node.js script
• Enables communication between parent and child via IPC (Inter-Process Communication)
• Lightweight compared to full process spawning for Node apps

Example:

// parent.js
const { fork } = require('child_process');

const child = fork('child.js');

child.on('message', (msg) => {
  console.log("Message from child:", msg);
});

child.send("Hello child");

// child.js
process.on('message', (msg) => {
  console.log("Message from parent:", msg);
  process.send("Hello parent");
});

22. Difference between spawn() and fork()

Example:

const { spawn } = require('child_process');
spawn('ls');

const { fork } = require('child_process');
fork('app.js');

23. How does Node.js handle child processes?

Node.js uses the child_process module to create separate processes.

Steps:

1. Parent process creates child
2. Child runs independently
3. Communication via:
   • IPC (fork)
   • stdin/stdout streams (spawn, exec)

Types:

• spawn() → stream-based
• exec() → buffer-based
• fork() → Node-specific with IPC

24. Difference between application-level and router-level middleware

Using Express.js

Example:

// Application-level
app.use((req, res, next) => {
  console.log("Global middleware");
  next();
});

// Router-level
const router = express.Router();

router.use((req, res, next) => {
  console.log("Router middleware");
  next();
});

25. What is error-handling middleware?

Error-handling middleware is used to handle errors in Express.

Special feature:

• Takes 4 parameters: (err, req, res, next)

Example:

app.use((err, req, res, next) => {
  console.error(err.message);
  res.status(500).send("Something went wrong");
});

26. What is next() in Express?

next() is a function used to pass control to the next middleware function in the stack.

Uses:

• Continue execution
• Pass errors → next(err)

Example:

app.use((req, res, next) => {
  console.log("Middleware 1");
  next();
});

app.use((req, res) => {
  res.send("Response");
});

27. How does Express handle async errors?

Express does not automatically catch async errors (in older patterns).

Solution:

Use try-catch or pass error to next()

Example:

app.get('/', async (req, res, next) => {
  try {
    throw new Error("Error occurred");
  } catch (err) {
    next(err);
  }
});

Or use wrapper:

const asyncHandler = fn => (req, res, next) =>
  Promise.resolve(fn(req, res, next)).catch(next);

28. What is request–response lifecycle in Express?

The lifecycle defines how a request is processed and response is returned.

Flow:

1. Client sends request
2. Request enters middleware
3. Middleware processes request
4. Route handler executes
5. Response is sent
6. Error middleware (if needed)

29. What is body-parser?

body-parser is middleware used to parse incoming request bodies.

Types:

• JSON parser
• URL-encoded parser

Example:

const bodyParser = require('body-parser');

app.use(bodyParser.json());

app.post('/user', (req, res) => {
  console.log(req.body);
  res.send("Received");
});

Note:
In newer Express versions, it is built-in:

app.use(express.json());

30. How do you handle errors gracefully in Express?

Best practices:

1. Use centralized error middleware
2. Use try-catch in async code
3. Send proper status codes
4. Avoid exposing sensitive data

Example:

app.get('/', async (req, res, next) => {
  try {
    throw new Error("Something failed");
  } catch (err) {
    next(err);
  }
});

app.use((err, req, res, next) => {
  res.status(500).json({
    message: err.message
  });
});

Authentication verifies who the user is. In Node.js, it is commonly implemented using:

Approaches:

1. Session-based authentication
2. Token-based authentication (JWT)

JWT Example:

const jwt = require('jsonwebtoken');

const token = jwt.sign({ userId: 1 }, 'secret', { expiresIn: '1h' });

// verify
jwt.verify(token, 'secret', (err, decoded) => {
  if (err) return console.log("Invalid token");
  console.log(decoded);
});

Flow:

1. User logs in
2. Server validates credentials
3. Token/session is created
4. User sends token with each request

32. How do you manage sessions in Node.js?

Sessions store user data on the server.

Common tool:

• express-session

Example:

const session = require('express-session');

app.use(session({
  secret: 'secret-key',
  resave: false,
  saveUninitialized: true
}));

app.get('/', (req, res) => {
  req.session.user = "John";
  res.send("Session stored");
});

Key points:

• Session ID stored in cookies
• Data stored on server

33. What is Passport.js?

Passport.js is middleware for handling authentication in Node.js.

Features:

• Supports multiple strategies
  • Local (username/password)
  • OAuth (Google, Facebook)
• Easy integration with Express

34. What is CORS?

CORS (Cross-Origin Resource Sharing) is a security mechanism that controls which domains can access your API.

Problem:

Browsers block requests from different origins by default.

35. How do you handle CORS?

Use middleware like cors.

Example:

const cors = require('cors');

app.use(cors({
  origin: 'http://example.com'
}));

You can allow:

• Specific domains
• All domains (*)

36. What are common security vulnerabilities in Node.js?

1. Cross-Site Scripting (XSS)
2. Cross-Site Request Forgery (CSRF)
3. SQL Injection
4. Command Injection
5. Insecure dependencies
6. Improper authentication

37. How do you secure cookies against XSS?

To protect cookies:

• Use httpOnly → prevents JavaScript access
• Use secure → HTTPS only
• Use sameSite → restrict cross-site usage

Example:

res.cookie('token', 'value', {
  httpOnly: true,
  secure: true,
  sameSite: 'Strict'
});

38. What is CSRF and how do you prevent it?

CSRF (Cross-Site Request Forgery) is an attack where a user is tricked into performing unwanted actions.

Prevention methods:

• CSRF tokens
• SameSite cookies
• Authentication checks

Example:
Use CSRF middleware:

const csrf = require('csurf');
app.use(csrf());

39. What is rate limiting?

Rate limiting restricts the number of requests a user can make in a given time.

Purpose:

• Prevent abuse
• Avoid DDoS attacks

Example:

const rateLimit = require('express-rate-limit');

app.use(rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100
}));

40. What is Helmet and why is it used?

Helmet is middleware that helps secure Express apps by setting HTTP headers.

It protects against:

• XSS
• Clickjacking
• MIME sniffing

Example:

const helmet = require('helmet');

app.use(helmet());

Passwords should never be stored in plain text. They must be hashed using strong algorithms.

Best practices:

• Use hashing algorithms like bcrypt
• Add salt (random data)
• Never store original password

Example:

const bcrypt = require('bcrypt');

const password = "mypassword";
const hashed = await bcrypt.hash(password, 10);

console.log(hashed);

// verify
const isMatch = await bcrypt.compare(password, hashed);
console.log(isMatch);

Key idea:

Hashing is one-way, so original password cannot be recovered.

42. How do you manage secrets and configuration?

Secrets like API keys, DB credentials should not be hardcoded.

Methods:

• Environment variables
• .env files using dotenv
• Secret managers (cloud services)

Example:

require('dotenv').config();

console.log(process.env.DB_URL);

Best practices:

• Never commit .env to Git
• Use different configs for dev and production

43. What is a stub?

A stub is a test double that replaces a real function with a controlled implementation.

Purpose:

• Isolate testing
• Return predefined data

Example:

function getData() {
  return "real data";
}

// stub replaces this in tests

44. What is mocking?

Mocking simulates the behavior of real objects in testing.

Difference from stub:

• Stub → returns fixed data
• Mock → also tracks interactions

Example:

const mockFn = jest.fn();
mockFn();

expect(mockFn).toHaveBeenCalled();

45. Difference between unit, integration, and end-to-end tests

Example:

• Unit → test a function
• Integration → test API + DB
• E2E → test full login flow

46. What is a test pyramid?

The test pyramid is a strategy for structuring tests.

Structure:

• Many unit tests
• Fewer integration tests
• Very few E2E tests

Reason:

• Unit tests are fast and cheap
• E2E tests are slow and complex

47. What is code coverage?

Code coverage measures how much of your code is tested.

Types:

• Line coverage
• Function coverage
• Branch coverage

Example:

• 80% coverage means 80% code is tested

48. How do you test asynchronous functions?

Use async tools like:

• async/await
• Promises
• Callbacks

Example (Jest):

test("async test", async () => {
  const data = await fetchData();
  expect(data).toBe("result");
});

49. What tools ensure consistent code style?

Common tools:

• ESLint → linting
• Prettier → formatting

Purpose:

• Maintain consistent code
• Catch errors early

50. Difference between SQL and NoSQL databases

51. How does Node.js connect to databases?

Node.js uses drivers or ORMs to connect to databases.

Examples:

• MongoDB → mongoose
• MySQL → mysql2

Example:

const mongoose = require('mongoose');

mongoose.connect('mongodb://localhost/test')
  .then(() => console.log("Connected"));

52. Can Node.js support JSON-based databases?

Yes, Node.js works well with JSON-based databases like:

• MongoDB
• Firebase

Reason:

JavaScript uses JSON natively, so integration is natural.

53. How does Node.js communicate with external services?

Node.js communicates using:

• HTTP/HTTPS requests
• APIs
• WebSockets

Example:

const axios = require('axios');

axios.get('https://api.example.com')
  .then(res => console.log(res.data));