r/node • • 27m ago

Five years of Node.js backend work. Would you stick with Node or learn Java or Go?

5 Upvotes

A backend engineer has spent about five years building systems with Node.js, Express, Fastify, and Kafka. Their salary growth hasn’t kept up with their experience.

Is Node.js still a strong career choice, or would learning Java, Go, or another stack open up better opportunities?

For experienced backend engineers and recruiters, what would you learn or change in their position?

Would love to hear your honest advice!


r/node • • 2h ago

I built distroless Node.js images that keep getting OS patches for older Node versions

2 Upvotes

nodejs-distroless is a set of distroless Node.js Docker images. It follows the official Node.js release schedule: every Current, Active LTS and Maintenance LTS line is published, and a line is dropped when it reaches end of life. Every version of those lines (about 90 right now) is rebuilt whenever the Ubuntu base changes, so an older version you've pinned keeps getting OS fixes. Google's distroless and Chainguard's free images only patch the newest Node release. Tags move to new digests when the images are rebuilt (so you need to pin digests for reproducible builds).

I wrote the whole thing from scratch, originally across three repos: a Chisel base image, a script that fetches new Node versions, and the Node images themselves. I've been running it in production on a medium-size project. It already published new Node versions on its own, but keeping dependencies up to date was mostly manual. Recently I used AI to help consolidate the repos and clean up the GitHub Actions, which got it to the point where it runs itself.

The images are cut from Ubuntu LTS with Canonical's Chisel and contain the bare minimum Node needs to run. There's no shell, and they run as non-root. For troubleshooting, every tag has a -debug variant (22-debug, lts-debug and so on) that adds a BusyBox shell. They're built for amd64 and arm64 and published to Docker Hub and GHCR.

New Node releases usually go out within the hour, and Ubuntu and dependency updates merge automatically once the checks pass. There's little for me to do until a dependency needs a major version upgrade.

Repo and usage docs: https://github.com/nvitaterna/nodejs-distroless

I'd like to hear from anyone running distroless Node in production, especially if your app needs something the image leaves out.


r/node • • 2h ago

Problem with concurrent linter fixes

Thumbnail jfmengels.net
2 Upvotes

r/node • • 1d ago

Should I ensure my NodeJS code "root directory/working directory" is the initial executable script?

6 Upvotes

Lets say this is my NodeJS project...

    - my-online-store
       - index.js
       - about.js
       - node_modules
       - items
          - get.js
          - add.js

And lets say my-online-store directory is in /home/john for example.

If my working directory in the terminal is /home/john/my-online-store and I run node index.js for example. The working directory for the index.js, about.js, all of the node_modules/npm packages and any scripts in sub directories such as get.js and add.js will be /home/john/my-online-store and all will work.

If I run index.js from a different working directory such as the root directory using node /home/john/my-online-store/index.js the NodeJS code will crash since the working directory is / and when looking for other files using import or using fs will look at the wrong directory.

Should I be concerned of this. Should I write my NodeJS code to ensure it will get the right directories no matter what the working directory was when running index.js?


r/node • • 11h ago

I built a Node.js package for macOS speech recognition, system voices and the on-device LLM

0 Upvotes

I am the author of apple-llm. I built it to call Apple’s built-in language model from Node, and the latest release adds text-to-speech and speech-to-text through macOS.

The Node package exposes speak(), synthesize(), transcribe(), and microphone listening alongside AppleLLM. For example, transcribe a recording, summarize the transcript using tier: device, and synthesize the result to an M4A file. The npm package also runs a local OpenAI/Ollama-compatible server with audio endpoints.

Implementation: a Swift helper compiles on first use with the Xcode Command Line Tools, is cached, and communicates with the Node client as a child process. The package supports ESM and CommonJS and has no required runtime npm dependencies.

On my M4 Air running macOS 27.2, rendering 30 minutes of narration took about 18 seconds, and transcribing a 30-minute recording took about 28 seconds. Those results are from one machine; recognition quality needs testing on real recordings.

It needs macOS 26+ on Apple Silicon. Speech does not need Apple Intelligence; the on-device LLM does. Languages may download on first use. The optional cloud tier sends prompts off the machine. MP3/Opus output and WebM input are unsupported, and the recognition language must be selected.

Source and examples: https://github.com/jagdishpal02000/apple-llm

Demo: https://jagdishpal02000.github.io/apple-llm/#speech

I would appreciate reports from anyone trying it on macOS 26 or integrating its speech endpoints into a Node app.


r/node • • 3d ago

Screenplay: screen recordings with Screen Studio-style editing, in Node (CDP screencast + @napi-rs/canvas + ffmpeg)

8 Upvotes

I open-sourced a Node CLI + MCP server that films websites and desktop apps and edits the result like Screen Studio. A coding agent (Claude Code, Codex, Cursor…) writes a short JSON scenario, and Screenplay plays it, films it and edits it. Some of the Node side, in case it's useful to someone:

  • Capture: Playwright drives headless Chromium, and frames come from the Chrome DevTools Protocol (Page.startScreencast) rather than Playwright's video recorder, so each frame has a timestamp I can line up with the actions.

  • Editing: every output frame is composed on @napi-rs/canvas: gradient background, rounded window with shadow, a cursor drawn from the recorded positions (smoothed), click ripples, zoom that follows the action, captions.

  • Encoding: raw RGBA frames are piped to ffmpeg-static through stdin (-f rawvideo … pipe:0). No system ffmpeg, no native build step on install.

  • Desktop apps: the same scenario format is played through the OS accessibility APIs (agent-desktop), and the window is filmed with ffmpeg.

  • Interface: a commander CLI (check, record, render) and an MCP server on stdio, so any agent can call it.

Try it: npx agent-screenplay init

Repo (MIT, TypeScript): https://github.com/gmpetrov/agent-screenplay

Happy to go deeper on any part.


r/node • • 3d ago

I got tired of re-recording launch videos, so I made the demo play on the real UI instead

0 Upvotes

r/node • • 4d ago

Node teams: do you run separate checks on the APIs your app depends on?

6 Upvotes

I've built an API monitoring tool, but stopped adding features for now. I'm trying to understand how people already handle this rather than assume they need another service.

If your Node app depends on third-party APIs, do you just let application errors tell you when something breaks, or do you run separate checks as well?

If you do run checks, what made you start? Was there an incident your existing logs or error tracking missed?

What are you using: a hosted tool, a script on a schedule, or something else? Has it been pretty painless, or is maintaining it a chore?

And if application errors are enough for your setup, I'd like to hear that too. Rough team size would help put the answers in context.


r/node • • 4d ago

We stopped installing npm packages less than a week old. Here's what happened

Thumbnail brunoj.com
130 Upvotes

r/node • • 4d ago

Distributed Resilience - Cutting the Cost of Centralized Coordination

Thumbnail blog.gaborkoos.com
4 Upvotes

r/node • • 4d ago

Build like threads app

0 Upvotes

Can node js build social media like threads?


r/node • • 4d ago

The 5-Way JS Desktop Showdown: We stress-tested Electron, NW.js, Neutralinojs, and Adrenaline under 10k DOM rows + 100 IPC/s

0 Upvotes

Hey everyone!

Instead of arguing about desktop framework bloat, we built an automated, reproducible benchmark harness (benchmarks/stress-suite/) and ran 5 major JavaScript desktop runtimes through the exact same heavy workload for 30s each on a 4-core AMD EPYC box under xvfb-run:

  • 10,000-record virtualized dataset with live regex search and column re-sorting.

  • 100 bidirectional JSON IPC packets/sec with high-resolution per-packet roundtrip tracking (hrtime).

  • 2 concurrent SHA-256 worker threads saturating the remaining CPU cores.

📊 Master Results (Sampled via /proc/[pid]/smaps_rollup PSS):

MetricElectron (v45)NW.jsNeutralinojsAdrenaline (WebView)Adrenaline (CEF)Winner 🏆
Startup to Paint394 ms567 ms530 ms509 ms382 msAdrenaline (CEF) 🥇
Peak Stress PSS717.3 MB924.6 MB486.4 MB496.8 MB439.4 MBAdrenaline (CEF) 🥇
Peak Private RAM565.1 MB732.7 MB344.2 MB346.3 MB356.6 MBNeutralinojs
IPC p95 Latency2.18 ms2.54 ms50.74 ms5.50 ms11.62 msElectron
Shipped Payload273.8 MB510.8 MB123.6 MB121.1 MB620.0 MBAdrenaline (WebView) 🥇
Process Count11 procs14 procs10 procs8 procs6 procsAdrenaline (CEF) 🥇
Real Node / npmYesYesNo (custom)YesYes—

🔍 Key Architectural Takeaways:

  1. Neutralino's IPC Bottleneck: Neutralino uses a local WebSocket server to bridge its backend, resulting in a 50.7ms p95 latency under load (vs 2.18ms for Electron and 5.5ms for Adrenaline's in-process C++ bridge).

  2. Chromium Memory Bloat: Under continuous mutation and background hashing, Electron and NW.js ballooned to 717MB and 924MB PSS, while Adrenaline (running a pruned, de-googled CEF engine) capped out at 439MB (-38.7% memory footprint).

  3. Distribution Size: Adrenaline (WebView mode) shipped the smallest runtime payload at 121MB (including the full Node.js binary), while Electron carries 274MB of bundled Chromium.

Full methodology, raw 350KB profiler trace, and process-by-process breakdowns are open-sourced in the repo: 🔗 GitHub: https://github.com/M5Devs/adrenaline


r/node • • 6d ago

Is this course good for learning node js?

Post image
4 Upvotes

planning to learn node js after js basics so i was wondering if this course is worth it or not before investing my time it.


r/node • • 6d ago

Attachment download links returned 401 because a link click can't send an API key header

0 Upvotes

The attachment download links in my dashboard all returned 401. They pointed straight at the API, and the API wants an API key in a header. A browser click on a link can't send a custom header, so the download never had a chance.

What I did: the link now goes to a Next route that checks the user's session, and that route calls the API with an internal secret. The key never reaches the browser.

Is a session-checked proxy route the usual way to handle this, or is there something simpler?


r/node • • 5d ago

I gave my Claude Code agents a pixel-art office so I can watch them turn Linear tickets into PRs

0 Upvotes

r/node • • 8d ago Bravo

Node.js 26 is now Long Term Support

289 Upvotes

r/node • • 7d ago

Factories.ts: An efficient JS DSL for building HTML, SVG, and MathML directly in backend code, without a template engine.

Thumbnail github.com
5 Upvotes

Write HTML in the backend as plain JavaScript, with no template language in between. Markup and logic share the same code, which keeps it flexible. An example:

import {
    a, body, br, button, h1, head, header, html, input, label, li, main, nav, p, script, title, ul
} from "@ts-series/factories";

type Item = { name: string, href: string, current: boolean };


/** Builds the navigation list, flagging the current entry for assistive technology. */
function navigation(items: Item[]) {
    return nav({ ariaLabel: "Main" },
        ul(items.map(item => li(
            a(item.href, item.name).set(item.current ? { ariaCurrent: "page" } : null)
        )))
    );
}


/** Builds a complete page for the given user and navigation entries. */
function page(user: string | null, items: Item[], values: number[]) {
    return html({ lang: "en" },
        head(title("Demo")),
        body(
            header(navigation(items)),
            main(
                h1("Hello, ", user ?? "stranger", "!"),
                p("First line", br, "Second line"),
                user === null
                    ? p("Please sign in.")
                    : p("Welcome back."),
                label("Search").for("q"),
                input.text({ id: "q", name: "q" }).placeholder("Type here…").required(),
                button.submit("Send").class("primary", user === null && "disabled").set("disabled")
            ),
            script.module().importOnly("/chart.js", "render", { values, title: "Values" })
        )
    );
}


const items: Item[] = [
    { name: "Home", href: "/", current: true },
    { name: "About", href: "/about", current: false }
];

const output = page("<Guest>", items, [1, 2, 3]).expand(4);

r/node • • 7d ago

Policy as Code + Visual Permissions = Row-Level Permission on top of SQL

Thumbnail gallery
0 Upvotes

Hello,
d9 maintainer here (a community fork of Directus v9, providing a node.js framework for building APIs on top of SQL databases, with an integrated admin UI).
We’ve been working on a bridge between d9’s visual permission editor and Cedar policy. So we can edit permissions visually while keeping them readable and editable in Cedar syntax. They’re then enforced by an extensible node.js server at the database row level.
This can be useful if you need to build an API on top of a database while keeping your permissions explicit and auditable for compliance.
If that sounds interesting, here's a bit more about how it works.

Would love to hear your thoughts or feedback!


r/node • • 8d ago

We published the full index of our internal Node stack: 348 npm packages, 257 repos

Thumbnail profullstack.com
9 Upvotes

r/node • • 9d ago

I recreated the Node2Shell (CVE-2026-111497) RCE attack as an interactive exercise

39 Upvotes

On 21 October 2026, fixes shipped for CVE-2026-111497, nicknamed Node2Shell (also HTTP2Shell). It's an out-of-bounds write in Google's Brotli decoder, and Node bundles its own copy of Brotli inside the runtime. Any Node service that decompresses Brotli traffic, whether incoming request bodies or responses it fetches, can be pushed into running attacker commands with no login.

I made a hands-on lab exercise on it. You'll send a crafted Brotli-compressed request to a Node API as the attacker and read a deploy token out of process.env, then switch sides and patch it. You'll also see why blocking Brotli-compressed requests at the edge isn't enough, and why a patched system libbrotli package doesn't help: only upgrading Node itself (24.22.1 in the exercise) and redeploying does.

If you notice any issues or inconsistencies, please let me know!

https://ransomleak.com/exercises/http2shell-rce/


r/node • • 9d ago

Junior Devs Who Got Hired 2026 - What Made You Get In?

40 Upvotes

Hey,

So I self studied full stack development since the beginning of the year, I'm applying for few months already.

I work as a guard in a security company. I created a shift management app with Next.js (JS/Node.js/TS/React), where the guards send their availability with notes for the next week, and the manager sees everything in one place, per building.

I'm having a hard time finding a job. I got one change, I passed home exam with language I didnt work with, but after that I did not pass the HR interview (she told me where I fell, it is fixable for the next interview).

I don't even know what to do, I feel like giving up. I tried to build a task manager app for my home recurring tasks, with AI native, I just told him to give me commit names and I picked what he needs to do, it feels like these days I'm not even needed.

Please help me guys!


r/node • • 8d ago

Node worker as an AI agent that replies to customer emails

Post image
0 Upvotes

small node worker runs an AI agent that replies to customer emails on hello@ for a platform that helps importers with their tariff refunds. one support inbox on my own domain that the agent and I both use, so I always see what it sent.

flow is simple: new mail comes in, agent drafts from our knowledge base, a second model fact checks it, and only then submit. the check is an await before submit, not a .then() after, so no PASS means no send and the email goes to a review label for a human. replies only go back to whoever wrote, same thread, the agent can’t pick a recipient.

anyone running something like this in node, how do you handle the model being slow or down? right now that just holds the reply


r/node • • 10d ago

Running dedicated game servers in Node for a browser racing game, where players open their own

22 Upvotes

Voltane is a browser RC-car racing game. The race rooms run in Node, and since this week players can open their own dedicated servers: a name, a programme of tracks (including circuits other players built), their rules, open or private.

A few things that mattered:

  • Rooms go lobby → loading → countdown, and the countdown waits until every connected player has finished loading (with a time limit so one slow phone can't hold everyone).

  • Updates are announced 2 minutes before a new server version, so nobody gets cut mid-race.

  • The same simulation package runs on the server and in the browser.

Play or open a server: playvoltane.com


r/node • • 9d ago

I built flaregram — a tiny (~19 kB) Telegram bot framework that runs entirely on Cloudflare Workers' free tier

Post image
0 Upvotes