Our per-tenant limit was 100 requests per second, yet one tenant pushed 310 through to a partner API that then blocked us. The Redis limiter read the counter, decided in Node, then wrote back. Moving the whole token bucket into one Lua script fixed it.
Our pipelines and Dockerfiles ran corepack enable before installing dependencies with pnpm. After we bumped the base image from Node.js 24 to 26, every build failed: corepack: command not found. Corepack is no longer bundled with Node.js from version 25. How we install it explicitly and keep versions pinned.
After we raised a Lambda timeout to handle large PDFs, customers started getting the same invoice email twice. The SQS queue's visibility timeout was still 60 seconds, so slow messages reappeared and a second invocation picked them up mid-processing.
We stopped adding patterns because a book listed them and kept only the three that removed real pain from a Node.js billing service: strategy for pricing rules, adapter for payment providers and plain constructor injection. Here is the before and after code.
A security review of a legacy customer portal found the password column was only Base64-encoded. Here is how we confirmed it, why encoding is not encryption, and how we moved 180,000 accounts to Argon2id with rehash-on-login and a targeted reset.
A Node.js API image had grown to 1.1 GB, slowing every deploy and autoscaling event. Step by step, we measured where the size came from, moved to a multi-stage build, chose a base image deliberately and cleaned the build context, ending at 96 MB, with the trade-offs of each step.
A traffic spike scaled our API from 8 to 30 pods, each with a 20-connection pool, and Postgres started refusing connections. Raising max_connections would have made it worse. We put PgBouncer in transaction mode in front and sized pools from the database side.
Most API vulnerabilities we find in reviews are missing defaults, not clever exploits: no body limits, validation on some routes, authorization in some handlers, stack traces in errors. The template we give teams starting a Node.js API, with the reasoning behind each default and code you can copy.
Our queue workers took exactly 30 seconds to stop on every deploy and lost the job they were processing. Exit code 137 in every pod. The Dockerfile used shell-form CMD, so /bin/sh was PID 1 and never forwarded SIGTERM to Node. Exec form plus a real shutdown handler fixed it.
We once spent two weeks optimizing SQL for an endpoint whose real cost was a logging call. Since then every performance task starts with a profile. Here is how we capture flame graphs in PHP, Node.js and Python, how to read them, and how to measure the win.
After we set "type": "module" in package.json, jest.mock stopped replacing our mailer and tests started calling the real SMTP client. Static ESM imports are linked before any mock runs. Here is the mechanism and the fix with unstable_mockModule.
Our partner OAuth server matched redirect_uri by prefix, and our login page followed any next URL. Chained together with a legacy implicit flow, an access token could land on an outside domain. We moved to exact matching, relative-only next and code plus PKCE.
A Node.js queue worker restarted a few times a day, dropping in-flight jobs. An analytics call was started without await or catch; when the analytics service failed, the rejection was unhandled and Node.js terminated the process, as it does by default since version 15. How we fixed it.
After we turned on streaming for our assistant, tool calls failed with JSON parse errors and sometimes ran with another call's arguments. We were parsing argument fragments per chunk and keying them by arrival order. Accumulating by index fixed it.
Our nightly report export ran perfectly when we typed it, and failed every night as a systemd service with node: command not found. Services get no login shell, no .bashrc and a working directory of /. Here is how we made the unit self-contained.
A low but stubborn rate of 502s at the load balancer and socket hang up errors between services turned out to be one race: Node closed idle keep-alive connections after 5 seconds while its callers kept reusing them.
A refactor passed a class method straight to .then() and our sync client started crashing with Cannot read properties of undefined (reading 'retries'). Methods do not carry their object with them. We compare bind, arrow fields and wrappers, including the arrow-field trap with subclasses.
Whenever someone exported a large CSV report, our Node.js API stopped answering everything else, including liveness probes, and pods restarted mid-export. Building 200,000 rows synchronously blocked the event loop for seconds. How we measured it and moved the work off the main thread.
Every deploy and every traffic burst, the first requests to our booking API timed out and Postgres started refusing clients. The handler did heavy setup and opened a fresh connection per invocation. Moving init out of the handler and adding RDS Proxy fixed it.
Video and dataset uploads of 5 to 15 GB kept failing through our API servers. We moved to browser-direct S3 multipart uploads with per-part presigned URLs, resumable state, per-part checksums and server-side completion. This is the full design and working code.
Users were logged out at random, mostly in the afternoon. Sessions and a fast-growing cache shared one Redis with allkeys-lru, so every hourly cache warm-up evicted idle sessions. Separate DB numbers would not have helped; separate instances did.
Our live support chat dropped every connection that stayed quiet for a minute, with close code 1006 and no server error. Nginx's 60-second proxy_read_timeout and the load balancer idle timeout were closing idle sockets. A heartbeat plus proxy tuning fixed it.
Our PDF invoices and the amounts charged through Stripe disagreed by a cent on 214 invoices in one month. Floats, toFixed and rounding at every step were to blame. We moved to integer minor units with one explicit rounding point.
Bumping React to 19 made npm install fail with ERESOLVE. The quick --legacy-peer-deps workaround installed, then crashed tooltips in staging. We learned to read the conflict, upgrade the real offender and use overrides only as a short, tested bridge.
After a routine deploy our Node.js API failed to start with EADDRINUSE on port 3000. Everyone blamed TIME_WAIT. The real cause was the old node process surviving the restart, because systemd only killed the npm wrapper above it. How we proved it with ss and fixed the unit.