Master 100 concepts with detailed explanations.
Node.js uses a single-threaded event loop with non-blocking I/O. Slow operations (disk, network) are offloaded to the OS or libuv thread pool. Their callbacks are queued and executed when the call stack is free, enabling high concurrency without threads.
require() is CommonJS - it loads and executes modules synchronously at runtime. ES module import is statically analysed at parse time, enables tree-shaking, and is asynchronous in nature. Both are supported in modern Node.js (.mjs or "type":"module" in package.json for ESM).
process.nextTick() queues the callback in the 'nextTick queue', which is processed after the current operation completes and before I/O events or timers. It runs even before Promise microtasks in some Node.js versions, making it higher priority than setImmediate.
Streams allow you to process data piece by piece (in chunks) rather than loading it all into memory. Node.js has four types: Readable, Writable, Duplex, and Transform. They are used for file I/O, HTTP, compression, and more.
The cluster module forks worker processes from a master process. Each worker shares the same TCP port, distributing incoming connections across multiple CPU cores. This lets a Node.js server take advantage of multi-core systems.
Middleware functions in Express have the signature (req, res, next). They can read/modify the request and response objects, execute any code, end the request-response cycle, or call next() to pass control to the next middleware.
package-lock.json records the exact resolved version, download URL, and integrity hash for every package in the dependency tree. This ensures that npm install produces the same node_modules on every machine and CI run.
Buffer represents a fixed-length sequence of bytes allocated outside the V8 JavaScript heap. It is used to handle binary data (files, network packets, crypto) before JavaScript had TypedArray support. Buffers are instances of Uint8Array.
fs.readFile() is asynchronous. It initiates the read operation and immediately returns, allowing other code to run. Once the OS delivers the data, the callback is invoked with (err, data). For synchronous reading, use fs.readFileSync().
__dirname is automatically set to the absolute path of the directory that contains the current module file. It differs from process.cwd(), which returns the directory from which the Node.js process was launched.
The event loop phases execute in this order: timers (setTimeout/setInterval callbacks), pending callbacks (I/O errors), idle/prepare (internal use), poll (retrieve new I/O events), check (setImmediate callbacks), and close callbacks (e.g., socket.on('close')). This cycle repeats continuously.
process.nextTick runs first (nextTick queue), then Promise microtasks (.then callbacks), then timers phase (setTimeout with 0ms), then check phase (setImmediate). The nextTick queue drains completely before microtasks, and both drain before the event loop advances phases.
Within the main module, their order is non-deterministic. Inside an I/O callback, setImmediate always fires before setTimeout(fn, 0) because the check phase comes before the timers phase wraps around. setImmediate is preferred for deferring within I/O callbacks.
Backpressure occurs when a Writable stream's internal buffer fills up. The write() method returns false, signaling the Readable to pause via pause(). When the Writable drains, it emits 'drain', and the Readable resumes. pipe() handles this automatically.
readable.pipe(writable) attaches the Writable as a destination. Data flows automatically from the Readable to the Writable, and pipe() handles backpressure by pausing the Readable when write() returns false and resuming on 'drain'. It returns the destination for chaining.
A Duplex stream (e.g., a TCP socket) has independent read and write sides that are unrelated to each other. A Transform stream (e.g., zlib.createGzip()) is a special Duplex where data written in is transformed and then readable out - the output derives from the input.
Buffer.alloc(n) allocates n bytes and zero-fills them for safety. Buffer.allocUnsafe(n) allocates the same n bytes but skips initialization, which is faster but may expose old memory contents. Use allocUnsafe only when you will immediately overwrite all bytes.
Buffer.from(string, encoding) creates a new Buffer from the given string using the specified encoding (default is 'utf8'). 'hello' in UTF-8 is 5 bytes. The resulting Buffer can be converted back with buf.toString('utf8').
spawn() streams stdio in real time, making it ideal for long-running processes or large output. exec() buffers the entire output in memory and calls back when done, capping at maxBuffer (default 1 MB). exec() also invokes a shell, so shell features like pipes work.
fork() is a specialization of spawn() designed for spawning Node.js processes. It establishes an IPC channel between parent and child, enabling process.send() and process.on('message') for structured communication. It is the foundation of the cluster module.
libuv maintains a thread pool (default 4 threads) for operations the OS cannot do asynchronously, such as file system calls and crypto. You can increase it by setting the UV_THREADPOOL_SIZE environment variable before starting Node.js (max 1024).
The first emit('data', 42) fires the listener, printing 'listener1 42'. Then removeAllListeners('data') removes all listeners for that event. The second emit('data', 99) finds no listeners and does nothing. No error is thrown for emitting with no listeners.
ee.once() wraps the handler so that after the first invocation it calls removeListener on itself. This is useful for one-time setup events like a server's 'listening' event or a stream's 'end' event.
By default, EventEmitter warns when more than 10 listeners are added for a single event, as this often indicates a memory leak (e.g., listeners added in a loop without cleanup). You can adjust the limit with emitter.setMaxListeners(n) or EventEmitter.defaultMaxListeners.
util.promisify(fn) takes a function that follows the Node.js error-first callback convention (err, value) and returns a new function that returns a Promise. This allows you to use async/await with older callback-based APIs like fs.readFile.
Node.js established the convention that asynchronous callbacks receive the error as their first parameter. If no error occurred, the first argument is null or undefined. This consistent pattern enabled libraries like async.js and util.promisify to work generically.
Inside an async function, try/catch correctly catches errors thrown by awaited Promises. When fetchData() throws, the rejection propagates to main(), where await unwraps it and the catch block handles it, printing 'caught: failed'.
process.env is a plain object populated from the shell's environment variables at process start. It is the standard way to read configuration (API keys, ports, NODE_ENV) without hardcoding values. Libraries like dotenv load .env files into process.env at startup.
path.join('a', 'b') simply joins segments with the platform separator and normalizes. path.resolve('a', 'b') processes segments right to left and builds an absolute path, prepending process.cwd() if no absolute segment is found. A leading '/' in a segment resets path.resolve.
__dirname is not available in ES modules. The equivalent pattern is: import { fileURLToPath } from 'url'; import { dirname } from 'path'; const __dirname = dirname(fileURLToPath(import.meta.url));. import.meta.url contains the file:// URL of the current module.
http.createServer(requestListener) creates an HTTP server. The listener receives IncomingMessage (req) and ServerResponse (res). writeHead sets the status code and headers, and res.end() sends the body and finalizes the response. server.listen() starts accepting connections.
app.use(path, fn) matches any HTTP method and performs prefix matching (e.g., '/api' matches '/api/users'). app.get(path, fn) only matches GET requests with exact path matching (ignoring query strings). app.use() is commonly used for middleware like body parsers.
Express 4 catches synchronous throws from route handlers and forwards them to error middleware. Async errors (rejected Promises, async function throws) must be caught and passed to next(err) manually - or use Express 5, which catches async errors automatically.
Express identifies error-handling middleware by its arity (4 parameters). The signature must be exactly (err, req, res, next), even if next is not used. Express skips this middleware for normal requests and routes errors to it via next(err).
req.params contains named route parameters (e.g., /users/:id). req.query contains parsed query string values after '?'. req.body contains the parsed request body, populated by body-parsing middleware like express.json() or express.urlencoded().
Node.js caches modules after the first require(). Subsequent require() calls return the same exported object from the cache. Since a and b reference the same object, mutating a.value is visible through b. This is stored in require.cache.
When A requires B and B requires A, Node.js breaks the cycle by returning A's partially-constructed exports object to B. Any exports added by A after the circular require call will not be visible to B at load time, which can cause undefined values and subtle bugs.
ESM imports are live bindings - they reference the actual exported variable, not a copy. In circular ESM graphs, an importing module may see undefined initially but the binding updates once the exporter finishes initializing. CJS copies the exported value at require time.
The main thread spawns a worker using the same file. isMainThread is false in the worker, so it reads workerData.n (10), computes 20, and sends it to the main thread with parentPort.postMessage(20). The main thread would receive this via worker.on('message').
SharedArrayBuffer allocates memory that is accessible from multiple worker threads simultaneously without the overhead of message-passing serialization. Since multiple threads write concurrently, you must use Atomics operations to prevent data races.
crypto.randomBytes(size) generates cryptographically secure random bytes using the operating system's entropy source (e.g., /dev/urandom on Linux). It is suitable for tokens, salts, and keys. Math.random() is predictable and unsuitable for security purposes.
createHash creates a Hash object. update() feeds data into it, and digest('hex') finalizes and returns the hash as a hex string. SHA-256 always produces 64 hex characters. Hashing is one-way - you cannot reverse it to get 'hello' back.
HMAC (Hash-based Message Authentication Code) combines a secret key with a hash algorithm to produce a tag that proves both message integrity and authenticity. In Node.js: crypto.createHmac('sha256', secret).update(message).digest('hex').
process.on('uncaughtException') catches synchronous exceptions that bubble up with no try/catch to handle them. The official Node.js recommendation is to use it only for cleanup and logging, then exit (process.exit(1)). Resuming execution after an uncaughtException is dangerous.
unhandledRejection fires when a Promise is rejected and no rejection handler is attached in the same tick. In Node.js 15+, an unhandled rejection causes the process to crash by default. The handler receives the reason (error) and the rejected Promise.
'C' prints synchronously. Then the microtask queue (Promise.resolve().then) drains, printing 'B'. Finally, the timers phase runs the setTimeout callback, printing 'A'. Microtasks always run before macrotasks (setTimeout, setImmediate).
fs.createReadStream(path) creates a Readable stream that reads the file in chunks (default 64 KB highWaterMark). It is ideal for large files such as logs or media because data is processed incrementally, keeping memory usage low compared to fs.readFile().
fs.promises (or import { readFile } from 'fs/promises') provides natively Promise-returning versions of all major fs methods. This allows clean async/await code without manual promisification. It is the preferred modern approach over fs.readFile with callbacks.
The scripts field lets you define project-level shell commands. Run them with 'npm run <name>'. Special names like 'start', 'test', 'build' can be run without 'run'. npm also has lifecycle scripts (preinstall, postinstall) that run automatically during install.
dependencies are packages needed for the application to run in production (e.g., express, mongoose). devDependencies are only needed during development (e.g., jest, eslint, typescript). Running 'npm install --production' or 'npm ci --omit=dev' skips devDependencies.
~1.2.3 allows updates from 1.2.3 to <1.3.0 (patch only). ^1.2.3 allows updates from 1.2.3 to <2.0.0 (minor and patch). Caret is npm's default when you 'npm install' a package. Both respect semver's promise that minor versions are backward compatible.
package-lock.json is npm's lock file in JSON format, including integrity checksums and resolved URLs. yarn.lock uses Yarn's own human-readable (but non-JSON) format. Both serve the same purpose - pinning exact dependency versions - but are not interchangeable between package managers.
cluster.isMaster is true in the primary process, which forks two workers. Each worker is a separate Node.js process. The cluster module uses OS-level socket sharing so all workers can accept connections on port 3000, distributing load across CPU cores.
When a child process is forked (via cluster.fork() or child_process.fork()), Node.js creates an IPC channel between parent and child. Messages are sent with process.send(obj) and received with process.on('message', handler), using structured clone serialization.
Running 'node' with no arguments starts the REPL. It reads an expression, evaluates it in the Node.js runtime, prints the result, and loops. The REPL is useful for quick experimentation. Special commands like .help, .exit, and .load are available.
V8 uses a generational garbage collector. New space (young generation) holds recently allocated objects using a fast Scavenge algorithm. Surviving objects are promoted to old space (old generation), collected less frequently using Mark-Sweep and Mark-Compact algorithms.
Emitting 'error' on an EventEmitter without a listener throws the error and crashes the process. Here, there is an 'error' listener, so it is called normally with the Error object, printing 'handled: oops'. Always add error listeners to EventEmitters.
EventEmitter treats 'error' events specially. If an 'error' event is emitted with no listener, Node.js throws the error as an uncaught exception. This will crash the process unless process.on('uncaughtException') is set. Always add an 'error' listener to streams and emitters.
setInterval(fn, ms) schedules fn to run every ms milliseconds, indefinitely. It returns an interval ID. clearInterval(id) cancels the interval. Not clearing intervals causes memory leaks because the callback and its closure are kept alive.
The interval fires at ~100ms, ~200ms, and ~300ms. On the third call count is 3, clearInterval(id) is called synchronously before the callback returns, cancelling all future invocations. Only 1, 2, 3 are logged.
execFile runs a binary directly without spawning a shell. This avoids shell injection vulnerabilities and reduces overhead. exec passes the command through /bin/sh, which allows shell features like pipes and redirection but is potentially unsafe with user-provided input.
The poll phase retrieves I/O events from the OS. If there are callbacks to execute, they run. If the queue empties, the loop either waits (blocks) for new I/O or moves on if timers are pending. This is where most of the 'blocking' in Node.js actually occurs.
The check phase runs setImmediate() callbacks. It executes immediately after the poll phase completes. This is why setImmediate() always fires before the next timer tick when called inside an I/O callback - the check phase comes before wrapping back to timers.
The close callbacks phase handles 'close' events emitted when a stream or socket is destroyed abruptly (not closed cleanly). For example, if a TCP socket is destroyed, its 'close' event callback runs in this phase. Clean closes emit their events earlier in the cycle.
When require('./mydir') is called and mydir is a folder, Node.js first checks for mydir/package.json and its 'main' field. If absent, it tries mydir/index.js, then mydir/index.node. This convention lets you package a module as a folder.
The 'main' field tells Node.js which file to use as the entry point when this package is required by another module. If absent, Node.js defaults to index.js. For ESM, the 'exports' field takes precedence over 'main'.
The transform function receives each chunk, converts it to uppercase with toUpperCase(), and passes it to callback(null, result), which pushes the transformed data downstream. Attaching the 'data' listener switches the stream to flowing mode and it prints 'HELLO'.
require.resolve(id) runs the module resolution algorithm and returns the resolved absolute path without loading the file. It is useful for checking whether a module exists or getting its path for use in other tools, without the side effect of executing the module.
require.cache is a plain object keyed by resolved file paths. To remove a module: delete require.cache[require.resolve('./myModule')]. The next require() call will re-execute the module file. This is sometimes used in hot-reloading scenarios or tests.
dotenv parses a .env file (KEY=value format) and merges those values into process.env. It is called with require('dotenv').config() or import 'dotenv/config' at application startup, before any other code reads process.env. The .env file should never be committed to version control.
An async generator (async function*) can use both await and yield. Each 'for await...of' iteration triggers the next fetch. This lazily paginates: one page is fetched per iteration, keeping memory use constant regardless of total pages.
With captureRejections: true (or EventEmitter.captureRejections = true), if an async event listener returns a rejected Promise, Node.js automatically routes the error to the emitter's 'error' event handler instead of letting it become an unhandledRejection.
If a browser renders the response as HTML, an attacker could craft a URL like /<script>alert(1)</script> to inject JavaScript (reflected XSS). Always sanitize or encode user-provided data before including it in responses, especially HTML responses.
process.exit(code) immediately terminates the process. It does not wait for pending I/O, timers, or async operations. The exit code (0 = success, non-zero = failure) is read by the calling shell or CI system. Natural termination waits for the event loop to drain.
add() returns a Promise that resolves to 5 after 100ms. await suspends main() until the Promise resolves, then assigns 5 to result. console.log prints 5. This demonstrates the core pattern of using async/await with Promise-based APIs.
Promise.all(iterable) waits for all Promises to fulfill. If any one rejects, the whole Promise.all() immediately rejects with that reason - the fast-fail behavior. Other Promises continue running but their results are ignored. Use Promise.allSettled() if you need all results.
Promise.allSettled() waits for all Promises to settle (fulfill or reject). It always resolves with an array of result objects: { status: 'fulfilled', value } or { status: 'rejected', reason }. It never rejects itself, making it ideal when you need all results regardless of failures.
Promise chaining works by passing the return value of each .then() handler as the argument to the next. The first handler receives 42 and returns 84 (42 * 2). The second handler receives 84. Both log their values in order.
The 'os' module exposes OS-level info: os.cpus() (CPU count and model), os.totalmem() / os.freemem() (RAM), os.hostname(), os.platform() ('linux', 'darwin', 'win32'), os.tmpdir(), and os.EOL (line ending). Useful for cross-platform scripts and diagnostics.
Pushing chunks to a Readable buffers them internally. Pushing null signals end-of-stream. Attaching a 'data' listener switches the stream to flowing mode, emitting each buffered chunk separately. 'chunk1' and 'chunk2' print on separate lines.
highWaterMark (default 16 KB for byte streams, 16 objects for object mode) is the buffer size threshold. When the internal buffer exceeds highWaterMark, push() returns false (Readable) or write() returns false (Writable), signaling the producer to pause and allowing backpressure to take effect.
Worker threads are ideal for CPU-intensive work (image processing, parsing) because they share memory via SharedArrayBuffer and avoid IPC serialization overhead. Cluster is designed to scale network servers across cores - each worker is a full Node.js process that handles HTTP connections independently.
The nextTick queue drains first (process.nextTick has highest priority). Then the Promise microtask queue drains. Finally, the check phase runs setImmediate. This order is fundamental to Node.js async scheduling and applies regardless of call location.
The 'net' module enables raw TCP networking: net.createServer() creates a TCP server, and net.createConnection() creates a TCP client. The 'http' module is built on top of 'net'. It is used for building custom protocols, proxies, and non-HTTP TCP services.
Promise.all() resolves to an array of fulfilled values in the same order as the input, regardless of resolution order. await unwraps the single Promise returned by Promise.all, so results is [1, 2, 3].
The zlib module wraps the zlib C library, providing compression algorithms (gzip, deflate, brotli) as Transform streams. Common use: piping a file read stream through zlib.createGzip() to compress it before writing or sending it over HTTP.
stream.pipeline() connects streams in order and handles backpressure, cleanup, and error propagation automatically. Here it reads input.txt, compresses via gzip Transform, and writes to output.gz. The callback is called on completion or error. It is preferred over manual pipe() chaining.
The WHATWG URL class (available globally in Node.js 10+) parses a URL string into components: protocol, hostname, port, pathname, search, hash, and a URLSearchParams object. new URL('https://example.com/path?q=1').searchParams.get('q') returns '1'.
fs.watch() uses OS-native events (inotify on Linux, kqueue on macOS, FSEvents on macOS, ReadDirectoryChangesW on Windows) and is more efficient. fs.watchFile() polls the file's stat at a configurable interval (default 5007ms). fs.watch() is more responsive but has cross-platform quirks.
router.param(name, callback) registers a pre-handler that fires whenever a route containing :name is matched. It is typically used to load a resource (e.g., find a user by ID) and attach it to req before the main route handler runs, reducing code duplication across routes.
The pending callbacks phase handles I/O callbacks deferred from the previous cycle, including some TCP error callbacks like ECONNREFUSED and EADDRINUSE. This is why certain I/O errors feel asynchronous even when they are predictable at server startup.
The 'querystring' module (legacy) parses and serializes URL query strings: querystring.parse('a=1&b=2') returns { a: '1', b: '2' }. The modern replacement is the WHATWG URLSearchParams class, available globally, which has a more complete API and is actively maintained.
Concatenating user input into exec() commands is a classic OS command injection vulnerability. An attacker could send host=; rm -rf / and the shell would execute both commands. Always use execFile() with arguments array, or validate and sanitize the input rigorously.
The built-in 'assert' module provides simple assertion functions like assert.strictEqual(), assert.deepStrictEqual(), assert.throws(), and assert.ok(). When an assertion fails, it throws an AssertionError. It is used for low-level invariant checks and simple unit tests.
ESM allows mixing named and default exports. The default export is imported without braces (multiply), and named exports are imported with braces ({ add }). Both are resolved statically. add(2,3) is 5 and multiply(2,3) is 6, so '5 6' is printed.
The 'timers/promises' module (Node.js 15+) exports setTimeout, setImmediate, and setInterval as Promise-returning functions. This enables 'await setTimeout(1000)' for clean async delays without wrapping callbacks in Promises manually.
The 'readline' module creates a line-by-line reader over a Readable stream. readline.createInterface({ input: process.stdin }) reads user input line by line. It is used for interactive CLI tools and for processing large text files efficiently without loading the whole file.
workerData is transferred to the worker via the structured clone algorithm - it is a deep copy, not a reference. The worker receives a clone of obj, reads name ('Node'), calls toUpperCase(), and posts 'NODE' back. eval: true allows passing a code string as the worker script.
NODE_ENV is a widely-adopted convention (not enforced by Node.js itself). Express enables production optimizations when NODE_ENV='production' (template caching, less verbose errors). Libraries check it to toggle debug logging. Setting it to 'test' allows test-specific behavior without code changes.
When a .then() throws, the error skips all subsequent .then() handlers until a .catch() (or .then(null, handler)) is reached. After catch handles the error and returns normally, the chain resumes. step2 is skipped, catch prints 'caught: step1 failed', then step4 prints.