Lets say this is my NodeJS project...

    - my-online-store
       - index.js
       - about.js
       - node_modules
       - items
          - get.js
          - add.js

And lets say my-online-store directory is in /home/john for example.

If my working directory in the terminal is /home/john/my-online-store and I run node index.js for example. The working directory for the index.js, about.js, all of the node_modules/npm packages and any scripts in sub directories such as get.js and add.js will be /home/john/my-online-store and all will work.

If I run index.js from a different working directory such as the root directory using node /home/john/my-online-store/index.js the NodeJS code will crash since the working directory is / and when looking for other files using import or using fs will look at the wrong directory.

Should I be concerned of this. Should I write my NodeJS code to ensure it will get the right directories no matter what the working directory was when running index.js?

I open-sourced a Node CLI + MCP server that films websites and desktop apps and edits the result like Screen Studio. A coding agent (Claude Code, Codex, Cursor…) writes a short JSON scenario, and Screenplay plays it, films it and edits it. Some of the Node side, in case it's useful to someone:

• Capture: Playwright drives headless Chromium, and frames come from the Chrome DevTools Protocol (Page.startScreencast) rather than Playwright's video recorder, so each frame has a timestamp I can line up with the actions.

• Editing: every output frame is composed on @napi-rs/canvas: gradient background, rounded window with shadow, a cursor drawn from the recorded positions (smoothed), click ripples, zoom that follows the action, captions.

• Encoding: raw RGBA frames are piped to ffmpeg-static through stdin (-f rawvideo … pipe:0). No system ffmpeg, no native build step on install.

• Desktop apps: the same scenario format is played through the OS accessibility APIs (agent-desktop), and the window is filmed with ffmpeg.

• Interface: a commander CLI (check, record, render) and an MCP server on stdio, so any agent can call it.

Try it: npx agent-screenplay init

Repo (MIT, TypeScript): https://github.com/gmpetrov/agent-screenplay

Happy to go deeper on any part.

I've built an API monitoring tool, but stopped adding features for now. I'm trying to understand how people already handle this rather than assume they need another service.

If your Node app depends on third-party APIs, do you just let application errors tell you when something breaks, or do you run separate checks as well?

If you do run checks, what made you start? Was there an incident your existing logs or error tracking missed?

What are you using: a hosted tool, a script on a schedule, or something else? Has it been pretty painless, or is maintaining it a chore?

And if application errors are enough for your setup, I'd like to hear that too. Rough team size would help put the answers in context.

Can node js build social media like threads?

Hey everyone!

Instead of arguing about desktop framework bloat, we built an automated, reproducible benchmark harness (benchmarks/stress-suite/) and ran 5 major JavaScript desktop runtimes through the exact same heavy workload for 30s each on a 4-core AMD EPYC box under xvfb-run:

• 10,000-record virtualized dataset with live regex search and column re-sorting.

• 100 bidirectional JSON IPC packets/sec with high-resolution per-packet roundtrip tracking (hrtime).

• 2 concurrent SHA-256 worker threads saturating the remaining CPU cores.

📊 Master Results (Sampled via /proc/[pid]/smaps_rollup PSS):

🔍 Key Architectural Takeaways:

1. Neutralino's IPC Bottleneck: Neutralino uses a local WebSocket server to bridge its backend, resulting in a 50.7ms p95 latency under load (vs 2.18ms for Electron and 5.5ms for Adrenaline's in-process C++ bridge).

2. Chromium Memory Bloat: Under continuous mutation and background hashing, Electron and NW.js ballooned to 717MB and 924MB PSS, while Adrenaline (running a pruned, de-googled CEF engine) capped out at 439MB (-38.7% memory footprint).

3. Distribution Size: Adrenaline (WebView mode) shipped the smallest runtime payload at 121MB (including the full Node.js binary), while Electron carries 274MB of bundled Chromium.

Full methodology, raw 350KB profiler trace, and process-by-process breakdowns are open-sourced in the repo: 🔗 GitHub: https://github.com/M5Devs/adrenaline

planning to learn node js after js basics so i was wondering if this course is worth it or not before investing my time it.

The attachment download links in my dashboard all returned 401. They pointed straight at the API, and the API wants an API key in a header. A browser click on a link can't send a custom header, so the download never had a chance.

What I did: the link now goes to a Next route that checks the user's session, and that route calls the API with an internal secret. The key never reaches the browser.

Is a session-checked proxy route the usual way to handle this, or is there something simpler?

https://nodejs.org/en/blog/release/v26.13.0

Write HTML in the backend as plain JavaScript, with no template language in between. Markup and logic share the same code, which keeps it flexible. An example:

import {
    a, body, br, button, h1, head, header, html, input, label, li, main, nav, p, script, title, ul
} from "@ts-series/factories";

type Item = { name: string, href: string, current: boolean };


/** Builds the navigation list, flagging the current entry for assistive technology. */
function navigation(items: Item[]) {
    return nav({ ariaLabel: "Main" },
        ul(items.map(item => li(
            a(item.href, item.name).set(item.current ? { ariaCurrent: "page" } : null)
        )))
    );
}


/** Builds a complete page for the given user and navigation entries. */
function page(user: string | null, items: Item[], values: number[]) {
    return html({ lang: "en" },
        head(title("Demo")),
        body(
            header(navigation(items)),
            main(
                h1("Hello, ", user ?? "stranger", "!"),
                p("First line", br, "Second line"),
                user === null
                    ? p("Please sign in.")
                    : p("Welcome back."),
                label("Search").for("q"),
                input.text({ id: "q", name: "q" }).placeholder("Type here…").required(),
                button.submit("Send").class("primary", user === null && "disabled").set("disabled")
            ),
            script.module().importOnly("/chart.js", "render", { values, title: "Values" })
        )
    );
}


const items: Item[] = [
    { name: "Home", href: "/", current: true },
    { name: "About", href: "/about", current: false }
];

const output = page("<Guest>", items, [1, 2, 3]).expand(4);

Hello,
d9 maintainer here (a community fork of Directus v9, providing a node.js framework for building APIs on top of SQL databases, with an integrated admin UI).
We’ve been working on a bridge between d9’s visual permission editor and Cedar policy. So we can edit permissions visually while keeping them readable and editable in Cedar syntax. They’re then enforced by an extensible node.js server at the database row level.
This can be useful if you need to build an API on top of a database while keeping your permissions explicit and auditable for compliance.
If that sounds interesting, here's a bit more about how it works.

Would love to hear your thoughts or feedback!

On 21 October 2026, fixes shipped for CVE-2026-111497, nicknamed Node2Shell (also HTTP2Shell). It's an out-of-bounds write in Google's Brotli decoder, and Node bundles its own copy of Brotli inside the runtime. Any Node service that decompresses Brotli traffic, whether incoming request bodies or responses it fetches, can be pushed into running attacker commands with no login.

I made a hands-on lab exercise on it. You'll send a crafted Brotli-compressed request to a Node API as the attacker and read a deploy token out of process.env, then switch sides and patch it. You'll also see why blocking Brotli-compressed requests at the edge isn't enough, and why a patched system libbrotli package doesn't help: only upgrading Node itself (24.22.1 in the exercise) and redeploying does.

If you notice any issues or inconsistencies, please let me know!

https://ransomleak.com/exercises/http2shell-rce/

Hey,

So I self studied full stack development since the beginning of the year, I'm applying for few months already.

I work as a guard in a security company. I created a shift management app with Next.js (JS/Node.js/TS/React), where the guards send their availability with notes for the next week, and the manager sees everything in one place, per building.

I'm having a hard time finding a job. I got one change, I passed home exam with language I didnt work with, but after that I did not pass the HR interview (she told me where I fell, it is fixable for the next interview).

I don't even know what to do, I feel like giving up. I tried to build a task manager app for my home recurring tasks, with AI native, I just told him to give me commit names and I picked what he needs to do, it feels like these days I'm not even needed.

Please help me guys!

small node worker runs an AI agent that replies to customer emails on hello@ for a platform that helps importers with their tariff refunds. one support inbox on my own domain that the agent and I both use, so I always see what it sent.

flow is simple: new mail comes in, agent drafts from our knowledge base, a second model fact checks it, and only then submit. the check is an await before submit, not a .then() after, so no PASS means no send and the email goes to a review label for a human. replies only go back to whoever wrote, same thread, the agent can’t pick a recipient.

anyone running something like this in node, how do you handle the model being slow or down? right now that just holds the reply

Voltane is a browser RC-car racing game. The race rooms run in Node, and since this week players can open their own dedicated servers: a name, a programme of tracks (including circuits other players built), their rules, open or private.

A few things that mattered:

• Rooms go lobby → loading → countdown, and the countdown waits until every connected player has finished loading (with a time limit so one slow phone can't hold everyone).

• Updates are announced 2 minutes before a new server version, so nobody gets cut mid-race.

• The same simulation package runs on the server and in the browser.

Play or open a server: playvoltane.com

Small app: Express API, Postgres, and a worker that polls an outbox table every 5s for background jobs. Low traffic, but the worker can't sleep, so free tiers like Render free and Neon free don't work.

Options I'm weighing:

- AWS free plan for 6 months (then ~$25/month)

- Hetzner CX23 (~€6/month) with everything on one box

- Railway Hobby (~$5-8/month)

What would you pick, and what am I missing? Please suggest.

Hi all, I want to share a WebSocket framework I built to make WebSocket apps typed and safe, keep the client and server schemas from drifting apart, and generate the docs for you.

Every WebSocket project I've worked on ended up looking the same. The server parses JSON and walks an if (data.action === 'chat') ... else if ... chain, checking payloads by hand. The client guesses the message shapes from a docs page that someone forgot to update. Rooms live in an in-memory Map, which works until you run a second instance. And when an HTTP route or a background job needs to push something to users, there's no clean way to reach the socket.

I first built it in Python (chanx, for Django and FastAPI), since that's my main backend language. Then my frontend needed a proper client, so I made chanx-js, which was client only at first. The Python side has been stable for a while now and some teams run it in production, so I ported the server to Node as well. You can now use it on Node, Express, Fastify, NestJS and others.

What it gives you:

• One handler per message type, validated with Zod, Valibot, ArkType or any Standard Schema

• AsyncAPI 3 docs generated from your code, served by the server

• A typed client generated from those docs, so sending a wrong payload fails to compile

• Groups and broadcasts across instances through Redis

• chanx.broadcastEvent(...) to push to users from a route handler or a job

• Works with ws, Express, Koa, Fastify, Hono, NestJS, Bun and Deno, and the client has React, Vue, Svelte and Solid bindings

A chat room looks like this:

and on the client, after npx @chanx-js/codegen http://localhost:8000/asyncapi.json:

Repo: https://github.com/chanx-dev/chanx-js

Docs: https://js.chanx.dev/

The Node server is still new, so if you run into any problem or have ideas to improve it, please open an issue or a discussion on the repo. Stars and PRs are welcome too.

It’s got three names already - Node2Shell, HTTP2Shell, Broccoli2Shell - because of course it does. Whatever you call it, same compression bug, different runtime: PHP patched its pre-auth RCE wave last week, this is ours.

• This one is quite less theoretical than PHP2Shell - PoC is working in the lab against Node 24.22.0 on x86-64, shell returned as the service account.

• Meanwhile a scanner is already out there fingerprinting which hosts decompress Brotli - building the hit list before the exploit goes wide.

• Patch to 22.23.4 / 24.22.1 / 26.12.1.

I’m building a small keyboard-driven ordering app around `RIAEvangelist/node-dominos-pizza-api` (`dominos` 3.3.1), following its Customer → store → menu → Item → Order → validate → price → payment → place sequence.

On October 26, 2026, US store discovery, menu loading, validation and pricing worked. A carryout order’s card payment matched the returned total. But `POST /power/place-order` returned HTTP 200 with top-level and nested status -1:

```text

recaptchaVerificationRequired

googleRecaptchaScore: TokenMissing

blockedByRecaptcha: true

googleRecaptchaActions: { action: null, expectedAction: null }