Blog

Five runs of the same one-million-allocation loop on Node 22, changing only how many objects stay reachable, move total GC time from 13 ms to 334 ms — and that single fact explains most of what people get wrong about V8's heap, Go's missing generations, and why Twitch's 10 GiB of useless memory made their API faster.

A WebSocket message is eleven bytes on the wire, and almost everything written about those bytes is checkable against a real socket in about a second.

Take a JSON Web Token apart segment by segment, build a signer and verifier with nothing but node:crypto, then run the alg:none and RS256-to-HS256 key-confusion attacks against both your own code and jose@6.2.8 to see exactly which one still forges an admin token.

Client-side validation is UX. Server-side validation is security. And a schema is not an auth guard — here's the fix that still ships an account takeover, and how to catch it in review.

Reading a 2 GB file all at once doesn't run out of memory — it hits V8's 512 MB string limit first. Streams process it in flat memory instead. Here's the pipeline pattern, custom Transform streams, and backpressure, with the numbers measured on Node 22.

The EventEmitter pattern lets components in the same process react to the same event without being directly coupled — no message broker needed.

Node.js runs on one CPU core by default. The cluster module lets you fork N workers across all cores — here's the pattern, graceful shutdown, IPC, and when PM2 makes it unnecessary.

Most Node.js services drop in-flight requests on every deploy. Here's the complete pattern: SIGTERM handling, HTTP draining, queue cleanup, and Kubernetes integration.

Build a pub/sub system from 60 lines of JavaScript: subscribe, publish, unsubscribe, once(), namespace wildcards, error isolation, and async publish.