Node.js — Skills Reference

Node.js — Skills Reference

Overview

A strong Node.js engineer reasons about the runtime, not just the library. That means understanding how the event loop schedules work, how to move data through streams without blowing memory, how modules resolve at runtime vs at build time, and how to keep services secure against injection and header-based attacks. The retired OpenJS exams (JSNAD and JSNSD) are used here only as a public competence map — they defined what practitioners must know without being about the exam itself.

Load this skill when… writing or reviewing Node.js services, CLIs, or Lambda handlers; debugging event-loop blocking or stream backpressure issues; auditing HTTP security (injection, Helmet, JWT); reviewing module/packaging configuration (ESM, exports map, npm ci). Not this skill: React UI concerns → see react; Next.js framework (App Router, Server Actions) → see nextjs; TypeScript type-system questions → see typescript; React Native/mobile runtime → see react-native.

Deeper context: Study resources, certification history, and learning paths live in references/study-resources.md. Load that file when planning a study path. Sibling skills: typescript, react, nextjs, react-native.

Verify steps assume nothing about your tooling — use your project's own scripts and the language toolchain (tsc, node, the test runner, the package manager), in that order of preference.

Credential context (retired JSNAD/JSNSD) and study path: see references/study-resources.md.

Uncertainty & Escalation

• Always re-verify live: Node.js LTS release lines and their API stability tier change on a schedule — APIs stable in Node 22 may be deprecated or removed in Node 24/26. [volatile — verify live] marks apply to: the node:test runner API surface (added Node 18, still gaining features each release); require(esm) support for CJS-loading ESM (available Node 20.17.0+, unflagged in 20.19.0+/22.12.0+, stable in 25.4.0 — behavior varies by version) [volatile — verify live]; stream.pipeline() Promise variant availability (node:stream/promises — verify against the project's Node version); worker_threads API surface (stable Node 12+, but options evolve). Check engines in package.json and the Node.js release schedule before relying on a version-specific API. Current LTS lines (2026-06-10): Node 26 is Current; Node 24 (Krypton) is Active LTS (recommended for production); Node 22 (Jod) is Maintenance LTS (security fixes only); Node 20 reached EOL March 24, 2026; Node 18 reached EOL March 27, 2025. [volatile — verify live]
• Live wins: the installed Node.js version's actual runtime behavior and the official Node.js docs are authoritative over this file → log discrepancies via Feedback protocol below.
• Escalate to a human: production deploys; dependency major-version bumps (especially express→fastify or Node LTS upgrades); data migrations; deleting or force-pushing git history; infrastructure changes (Redis, load balancer config, rate-limit store).
• Confidence taxonomy: facts in this file are stable unless tagged [volatile — verify live] or [opinion — house style].

Specific volatile facts in this skill:

• require(esm) in CJS files — [volatile — verify live] — available since Node 20.17.0 (behind --experimental-require-module); unflagged and warning-free in Node 20.19.0+/22.12.0+/23.0.0+; marked fully stable (non-experimental) in Node 25.4.0. Not available in Node 18 or Node 20 < 20.17.0.
• node:test runner API (e.g., --test, --test-reporter) — [volatile — verify live] — features added each LTS cycle.
• stream.pipeline() from node:stream/promises — [volatile — verify live] — verify it exists in the project's Node version (Node 15+).
• Fastify vs Express security default behavior (Helmet bundled, AJV schema validation) — [volatile — verify live] — confirm against installed library version.

1. Async Node.js and the Event Loop

The event loop is the single most misunderstood aspect of Node.js. Every performance problem traces back to either blocking the loop or failing to handle backpressure.

Event loop phases (in order): timers (setTimeout/setInterval) → pending I/O callbacks → idle/prepare → poll (new I/O) → check (setImmediate) → close callbacks. Then repeat.