Express.js vs NestJS Interview Questions and Answers 2026

Express.js and NestJS are the two most common Node.js backend frameworks in production. Candidates report that the core differences in architecture and philosophy, NestJS dependency injection and module system, middleware vs guards/interceptors, and when to choose each framework are the most frequently tested topics in Node.js backend developer interviews. This guide covers 45 questions with direct code comparisons. Always confirm which framework and Node.js version your target company uses on their official careers portal.

Table of Contents

1. Framework Fundamentals
2. Express.js Core Concepts
3. NestJS Architecture
4. Dependency Injection in NestJS
5. Request Lifecycle
6. Database Integration
7. Performance and Deployment
8. 5-Question Mock Test
9. Frequently Asked Questions

Framework Fundamentals

Q1. What is Express.js and what are its design principles? Easy

Express.js is a minimal, unopinionated web framework for Node.js. It provides:

• HTTP method routing (get, post, put, delete, patch)
• Middleware pipeline for request processing
• Template engine integration
• Static file serving

Its design principles: do one thing well (routing + middleware), stay minimal (no MVC structure, no ORM, no authentication built-in), maximize flexibility (compose what you need).

const express = require('express')
const app = express()

app.use(express.json())
app.use(express.urlencoded({ extended: true }))

app.get('/users', async (req, res) => {
  const users = await User.findAll()
  res.json(users)
})

app.listen(3000, () => console.log('Server on port 3000'))

Q2. What is NestJS and why was it created? Easy

NestJS is a structured Node.js framework built on TypeScript, inspired by Angular's architecture. It was created to solve the architectural anarchy that often occurs in large Express applications by providing:

• A module system for organizing code
• Dependency injection (IoC container)
• Opinionated patterns for controllers, services, and repositories
• First-class TypeScript with decorators
• Built-in support for testing, microservices, GraphQL, WebSockets

NestJS uses Express or Fastify as the underlying HTTP adapter but adds a complete application framework on top.

Q3. When should you choose Express over NestJS and vice versa? Medium

Express: simple APIs, scripts, proxies, serverless functions, teams with strong existing architecture. NestJS: enterprise APIs, teams that want guardrails, microservices, anything needing GraphQL + REST + WebSockets in one codebase.

Express.js Core Concepts

Q4. How does Express middleware work? Easy

Middleware functions have the signature (req, res, next). They run in the order they are registered. next() passes control to the next middleware; next(err) skips to error-handling middleware.

// Application-level middleware
app.use((req, res, next) => {
  console.log(`${req.method} ${req.path}`)
  next()
})

// Route-level middleware
const authMiddleware = (req, res, next) => {
  const token = req.headers.authorization?.split(' ')[1]
  if (!token) return res.status(401).json({ error: 'Unauthorized' })
  try {
    req.user = verifyToken(token)
    next()
  } catch {
    res.status(401).json({ error: 'Invalid token' })
  }
}

app.get('/profile', authMiddleware, (req, res) => {
  res.json(req.user)
})

// Error-handling middleware (4 params)
app.use((err, req, res, next) => {
  console.error(err.stack)
  res.status(err.status ?? 500).json({ error: err.message })
})

Q5. What is the Express router and how do you organize routes? Medium

// routes/users.js
const router = require('express').Router()

router.use(authMiddleware) // all routes in this file require auth

router.get('/', async (req, res, next) => {
  try {
    const users = await userService.findAll({ page: req.query.page })
    res.json(users)
  } catch (err) {
    next(err)
  }
})

router.get('/:id', async (req, res, next) => {
  try {
    const user = await userService.findById(req.params.id)
    if (!user) return res.status(404).json({ error: 'Not found' })
    res.json(user)
  } catch (err) {
    next(err)
  }
})

router.post('/', validate(createUserSchema), async (req, res, next) => {
  try {
    const user = await userService.create(req.body)
    res.status(201).json(user)
  } catch (err) {
    next(err)
  }
})

module.exports = router

// app.js
app.use('/api/users', require('./routes/users'))
app.use('/api/posts', require('./routes/posts'))

Q6. How do you handle errors in Express? Medium

// Custom error class
class AppError extends Error {
  constructor(message, statusCode = 500) {
    super(message)
    this.statusCode = statusCode
  }
}

// Async wrapper to avoid try/catch everywhere
const asyncHandler = (fn) => (req, res, next) => {
  Promise.resolve(fn(req, res, next)).catch(next)
}

// Route using asyncHandler
app.get('/users/:id', asyncHandler(async (req, res) => {
  const user = await User.findById(req.params.id)
  if (!user) throw new AppError('User not found', 404)
  res.json(user)
}))

// Global error handler (must be LAST middleware)
app.use((err, req, res, next) => {
  if (err instanceof AppError) {
    return res.status(err.statusCode).json({ error: err.message })
  }
  // Mongoose validation error
  if (err.name === 'ValidationError') {
    return res.status(400).json({ error: err.message })
  }
  // Unknown error
  console.error(err)
  res.status(500).json({ error: 'Internal server error' })
})

Q7. Predict the output: Medium

const app = require('express')()

app.use((req, res, next) => {
  console.log('1')
  next()
})

app.get('/test', (req, res, next) => {
  console.log('2')
  next()
})

app.use((req, res, next) => {
  console.log('3')
  res.send('ok')
})

app.use((req, res, next) => {
  console.log('4')
  res.send('second')
})

For a GET /test request, output:

1
2
3

Explanation: Middleware 1 runs (app-level, all routes). Route handler for GET /test runs and calls next(). Middleware 3 runs and calls res.send('ok'), sending the response. Middleware 4 is never reached because the response was already sent (Express does not throw, but subsequent res.send calls would log a "headers already sent" warning if attempted).

Q8. What is CORS and how do you configure it in Express? Easy

const cors = require('cors')

// Allow all origins (not for production)
app.use(cors())

// Specific configuration
app.use(cors({
  origin: ['https://myapp.com', 'https://staging.myapp.com'],
  methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  credentials: true, // allow cookies
  maxAge: 86400, // preflight cache (seconds)
}))

// Per-route CORS
app.get('/public', cors(), (req, res) => res.json({ data: 'public' }))
app.post('/protected', cors({ origin: 'https://myapp.com' }), handler)

// Manual CORS (no library)
app.use((req, res, next) => {
  res.header('Access-Control-Allow-Origin', 'https://myapp.com')
  res.header('Access-Control-Allow-Methods', 'GET,POST,PUT,DELETE')
  res.header('Access-Control-Allow-Headers', 'Content-Type,Authorization')
  if (req.method === 'OPTIONS') return res.sendStatus(204)
  next()
})

NestJS Architecture

Q9. What is the NestJS module system? Medium

// Feature module
import { Module } from '@nestjs/common'
import { TypeOrmModule } from '@nestjs/typeorm'
import { UsersController } from './users.controller'
import { UsersService } from './users.service'
import { User } from './user.entity'

@Module({
  imports: [TypeOrmModule.forFeature([User])], // import entity repository
  controllers: [UsersController],              // handle HTTP requests
  providers: [UsersService],                  // injectable services
  exports: [UsersService],                    // available to importing modules
})
export class UsersModule {}

// Root module
@Module({
  imports: [
    ConfigModule.forRoot({ isGlobal: true }),
    TypeOrmModule.forRootAsync({ ... }),
    UsersModule,
    PostsModule,
    AuthModule,
  ],
})
export class AppModule {}

// main.ts
async function bootstrap() {
  const app = await NestFactory.create(AppModule)
  app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }))
  app.useGlobalFilters(new HttpExceptionFilter())
  app.setGlobalPrefix('api/v1')
  await app.listen(3000)
}

Q10. How do you create a controller and service in NestJS? Easy

// users.controller.ts
import { Controller, Get, Post, Body, Param, Delete, Put, UseGuards } from '@nestjs/common'
import { UsersService } from './users.service'
import { CreateUserDto } from './dto/create-user.dto'
import { AuthGuard } from '../auth/auth.guard'

@Controller('users')
@UseGuards(AuthGuard)
export class UsersController {
  constructor(private readonly usersService: UsersService) {}

  @Get()
  findAll() {
    return this.usersService.findAll()
  }

  @Get(':id')
  findOne(@Param('id') id: string) {
    return this.usersService.findOne(+id)
  }

  @Post()
  create(@Body() dto: CreateUserDto) {
    return this.usersService.create(dto)
  }

  @Put(':id')
  update(@Param('id') id: string, @Body() dto: Partial<CreateUserDto>) {
    return this.usersService.update(+id, dto)
  }

  @Delete(':id')
  remove(@Param('id') id: string) {
    return this.usersService.remove(+id)
  }
}

// users.service.ts
import { Injectable, NotFoundException } from '@nestjs/common'
import { InjectRepository } from '@nestjs/typeorm'
import { Repository } from 'typeorm'
import { User } from './user.entity'

@Injectable()
export class UsersService {
  constructor(
    @InjectRepository(User)
    private readonly userRepo: Repository<User>
  ) {}

  findAll() {
    return this.userRepo.find()
  }

  async findOne(id: number) {
    const user = await this.userRepo.findOne({ where: { id } })
    if (!user) throw new NotFoundException(`User #${id} not found`)
    return user
  }

  create(dto: CreateUserDto) {
    return this.userRepo.save(this.userRepo.create(dto))
  }

  async update(id: number, dto: Partial<CreateUserDto>) {
    await this.userRepo.update(id, dto)
    return this.findOne(id)
  }

  async remove(id: number) {
    const user = await this.findOne(id)
    return this.userRepo.remove(user)
  }
}

Q11. What are NestJS Guards, Interceptors, and Pipes? Medium

// Guard: decides if request proceeds (auth, RBAC)
@Injectable()
export class JwtAuthGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest()
    const token = request.headers.authorization?.split(' ')[1]
    if (!token) return false
    try {
      request.user = this.jwtService.verify(token)
      return true
    } catch {
      throw new UnauthorizedException()
    }
  }
}

// Interceptor: transform response, add logging, caching
@Injectable()
export class TransformInterceptor<T> implements NestInterceptor<T, ApiResponse<T>> {
  intercept(context: ExecutionContext, next: CallHandler): Observable<ApiResponse<T>> {
    return next.handle().pipe(
      map(data => ({ data, success: true, timestamp: new Date().toISOString() }))
    )
  }
}

// Pipe: validate and transform input data
@Injectable()
export class ParseIntPipe implements PipeTransform {
  transform(value: string): number {
    const val = parseInt(value, 10)
    if (isNaN(val)) throw new BadRequestException(`${value} is not a number`)
    return val
  }
}

// Usage (execution order: Guard → Interceptor(before) → Pipe → Handler → Interceptor(after) → Filter)
@Get(':id')
@UseGuards(JwtAuthGuard)
@UseInterceptors(TransformInterceptor)
findOne(@Param('id', ParseIntPipe) id: number) {
  return this.usersService.findOne(id)
}

Q12. What are NestJS DTOs and how does class-validator work? Medium

import { IsEmail, IsString, MinLength, IsOptional, IsEnum } from 'class-validator'
import { Transform } from 'class-transformer'

export enum UserRole {
  USER = 'user',
  ADMIN = 'admin',
}

export class CreateUserDto {
  @IsString()
  @MinLength(2)
  name: string

  @IsEmail()
  @Transform(({ value }) => value.toLowerCase())
  email: string

  @IsString()
  @MinLength(8)
  password: string

  @IsOptional()
  @IsEnum(UserRole)
  role?: UserRole
}

// main.ts: enable validation globally
app.useGlobalPipes(new ValidationPipe({
  whitelist: true,        // strip unknown properties
  forbidNonWhitelisted: true, // throw on unknown properties
  transform: true,        // auto-transform to DTO class instance
  transformOptions: {
    enableImplicitConversion: true // string '1' → number 1
  }
}))

Dependency Injection in NestJS

Q13. How does NestJS dependency injection work? Medium

NestJS's IoC container uses the module metadata to build a dependency graph and inject providers via constructor injection.

// Custom provider: factory
@Module({
  providers: [
    {
      provide: 'DATABASE_CONFIG',
      useFactory: (configService: ConfigService) => ({
        host: configService.get('DB_HOST'),
        port: configService.get<number>('DB_PORT'),
      }),
      inject: [ConfigService],
    },
    {
      provide: PaymentGateway,       // token (class or string/symbol)
      useClass: StripeGateway,       // class to instantiate
    },
    {
      provide: 'API_KEY',
      useValue: process.env.API_KEY, // static value
    },
  ],
})

// Inject in service
@Injectable()
export class CheckoutService {
  constructor(
    private readonly payment: PaymentGateway,
    @Inject('API_KEY') private readonly apiKey: string,
    @Inject('DATABASE_CONFIG') private readonly dbConfig: DbConfig,
  ) {}
}

// Scopes
@Injectable({ scope: Scope.REQUEST }) // new instance per request
export class RequestLogger { ... }

@Injectable({ scope: Scope.TRANSIENT }) // new instance per injection
export class TransientService { ... }

Q14. What is the difference between global and scoped providers in NestJS? Advanced

By default, providers are singletons within a module. Marking a module or provider as global makes its providers available everywhere without importing the module.

// Global module: available in all modules without importing
@Global()
@Module({
  providers: [ConfigService, DatabaseService],
  exports: [ConfigService, DatabaseService],
})
export class CoreModule {}

// Non-global: must be imported explicitly
@Module({
  imports: [UsersModule], // required to access UsersService
})
export class PostsModule {}

// REQUEST scope: new instance per HTTP request
// Useful for: logging with correlation IDs, request-specific user context
@Injectable({ scope: Scope.REQUEST })
export class RequestContextService {
  private readonly correlationId = uuid()
  getCorrelationId() { return this.correlationId }
}

Request Lifecycle

Q15. What is the request lifecycle in NestJS? Medium

NestJS processes requests through a defined pipeline:

1. Middleware (Express-level, before NestJS handles the request)
2. Guards (canActivate - authentication/authorization)
3. Interceptors (before handler)
4. Pipes (parameter transformation/validation)
5. Route Handler (controller method)
6. Interceptors (after handler - transform response)
7. Exception Filters (if any exception was thrown at any step)

// Full example showing all layers
@Controller('orders')
@UseGuards(AuthGuard)           // 2. Auth guard
@UseInterceptors(LogInterceptor) // 3/6. Log before/after
@UsePipes(ValidationPipe)        // 4. Validate body
@UseFilters(HttpExceptionFilter) // 7. Catch exceptions
export class OrdersController {
  @Post()
  create(
    @Body() dto: CreateOrderDto,              // 4. Validated/transformed
    @CurrentUser() user: User,                // Custom param decorator
  ) {
    return this.ordersService.create(dto, user) // 5. Handler executes
  }
}

Q16. How do you implement authentication in NestJS with JWT? Advanced

// auth.module.ts
@Module({
  imports: [
    JwtModule.registerAsync({
      inject: [ConfigService],
      useFactory: (config: ConfigService) => ({
        secret: config.get('JWT_SECRET'),
        signOptions: { expiresIn: '15m' },
      }),
    }),
  ],
  providers: [AuthService, JwtStrategy],
  exports: [AuthService],
})
export class AuthModule {}

// auth.service.ts
@Injectable()
export class AuthService {
  constructor(
    private readonly usersService: UsersService,
    private readonly jwtService: JwtService,
  ) {}

  async login(dto: LoginDto) {
    const user = await this.usersService.validateCredentials(dto.email, dto.password)
    if (!user) throw new UnauthorizedException('Invalid credentials')

    const payload = { sub: user.id, email: user.email, role: user.role }
    return {
      access_token: this.jwtService.sign(payload),
      refresh_token: this.jwtService.sign(payload, { expiresIn: '7d' }),
    }
  }
}

// jwt.guard.ts
@Injectable()
export class JwtAuthGuard extends AuthGuard('jwt') {
  handleRequest(err: any, user: any, info: any) {
    if (err || !user) throw err || new UnauthorizedException()
    return user
  }
}

Database Integration

Q17. How do you use TypeORM with NestJS? Medium

// user.entity.ts
import { Entity, PrimaryGeneratedColumn, Column, CreateDateColumn, OneToMany } from 'typeorm'

@Entity('users')
export class User {
  @PrimaryGeneratedColumn()
  id: number

  @Column({ unique: true })
  email: string

  @Column()
  name: string

  @Column({ select: false }) // not selected by default
  password: string

  @CreateDateColumn()
  createdAt: Date

  @OneToMany(() => Post, (post) => post.author)
  posts: Post[]
}

// app.module.ts
TypeOrmModule.forRootAsync({
  inject: [ConfigService],
  useFactory: (config: ConfigService) => ({
    type: 'postgres',
    url: config.get('DATABASE_URL'),
    entities: [__dirname + '/**/*.entity{.ts,.js}'],
    synchronize: config.get('NODE_ENV') !== 'production',
    logging: config.get('NODE_ENV') === 'development',
  }),
})

// Repository usage in service
async findWithPosts(id: number): Promise<User> {
  return this.userRepo.findOne({
    where: { id },
    relations: { posts: true },
    select: { id: true, email: true, name: true }
  })
}

Q18. What is Prisma and how does it compare to TypeORM in NestJS? Advanced

// Prisma in NestJS
@Injectable()
export class PrismaService extends PrismaClient implements OnModuleInit {
  async onModuleInit() {
    await this.$connect()
  }
}

@Injectable()
export class UsersService {
  constructor(private readonly prisma: PrismaService) {}

  findAll() {
    return this.prisma.user.findMany({
      include: { posts: { where: { published: true } } },
      orderBy: { createdAt: 'desc' },
    })
  }

  create(data: Prisma.UserCreateInput) {
    return this.prisma.user.create({ data })
  }
}

Performance and Deployment

Q19. How do you improve Express.js performance? Advanced

1. Compression: compress response bodies
2. Caching: HTTP cache headers, Redis for data cache
3. Clustering: use all CPU cores with Node.js cluster module or PM2
4. Connection pooling: database connection pooling (pg-pool, Sequelize pool)
5. Avoid synchronous code: never block the event loop

const compression = require('compression')
const cluster = require('cluster')
const os = require('os')

app.use(compression()) // gzip responses

// PM2 cluster mode (recommended over manual clustering)
// pm2 start app.js -i max  (uses all CPUs)

// Rate limiting
const rateLimit = require('express-rate-limit')
app.use('/api', rateLimit({
  windowMs: 15 * 60 * 1000, // 15 min
  max: 100,
  standardHeaders: true,
}))

// Response caching with Redis
app.get('/products', async (req, res) => {
  const cached = await redis.get('products')
  if (cached) return res.json(JSON.parse(cached))

  const products = await Product.find()
  await redis.setex('products', 300, JSON.stringify(products)) // 5 min TTL
  res.json(products)
})

Q20. What is Fastify and how does NestJS use it? Advanced

Fastify is a high-performance Node.js HTTP framework with a built-in schema-based JSON serialization (uses fast-json-stringify) and validation (uses ajv). NestJS supports Fastify as an alternative to Express via adapters.

// main.ts with Fastify adapter
import { FastifyAdapter, NestFastifyApplication } from '@nestjs/platform-fastify'

async function bootstrap() {
  const app = await NestFactory.create<NestFastifyApplication>(
    AppModule,
    new FastifyAdapter({ logger: true })
  )
  await app.listen(3000, '0.0.0.0') // Fastify requires explicit host
}

Fastify benchmarks show it handles more requests per second than Express due to its JSON serialization optimizations. Use Fastify adapter in NestJS when raw throughput is critical (high-traffic APIs). Note: not all Express middleware is compatible; must use Fastify plugins.

5-Question Mock Test

Q1. What is the difference between Express middleware and NestJS Guards/Interceptors/Pipes? When would you use each NestJS building block?

Q2. Write an Express error-handling middleware signature and explain when it runs.

Q3. In NestJS, what is the order of execution for: Middleware, Pipe, Guard, Interceptor, and Route Handler?

Q4. What is the N+1 problem and how would you solve it when using TypeORM in NestJS?

Q5. When should you choose Express.js over NestJS for a new project?

Answers:

A1. Express middleware handles all cross-cutting concerns in one construct. NestJS separates them: Guards = authorization (canActivate before handler), Interceptors = transform/log requests and responses (wrap handler), Pipes = validate/transform input data (before handler arguments). This separation makes each concern testable in isolation.

A2. (err, req, res, next) => {}. Express recognizes error-handling middleware by the 4-parameter signature. It runs when any middleware or route handler calls next(err) or throws synchronously.

A3. Middleware → Guard → Interceptor (pre) → Pipe → Route Handler → Interceptor (post) → Exception Filter (if error thrown anywhere).

A4. Loading entities then accessing a relation for each in a loop causes N+1 queries. Fix with eager loading: this.repo.findOne({ where: { id }, relations: { posts: true } }) or QueryBuilder.leftJoinAndSelect.

A5. Express when: small team, simple API, team prefers flexibility, serverless/edge functions (lower cold-start), integrating into existing non-NestJS Node codebase, or team dislikes decorator-heavy TypeScript. NestJS when: team needs enforced architecture, large codebase, microservices, strong TypeScript, or Angular developers who already know the pattern.

Frequently Asked Questions

Is Express.js still relevant in 2026?

Yes. Express is the most deployed Node.js framework. Most production Node.js APIs still run Express. It underpins NestJS and is used in serverless contexts. New projects may prefer NestJS or Fastify, but Express expertise is required at many companies. Candidates report Express questions alongside NestJS in backend interviews.

What is the difference between NestJS and Express.js for microservices?

NestJS has built-in microservice support: transport layers (TCP, Redis, NATS, Kafka, gRPC, RabbitMQ) via @nestjs/microservices. Switching from HTTP to message-based communication requires changing the adapter. Express requires manual setup of message queue clients and lacks the structure NestJS provides for message patterns.

What is the difference between NestJS Guards and Middleware for authentication?

Both can check tokens, but Guards have access to the ExecutionContext (HTTP, WebSocket, RPC context), making them transport-agnostic. They receive the controller and method metadata for role-based access. Middleware only sees HTTP context. For authentication that should work across REST, WebSockets, and microservices, Guards are preferred.

What is the internal mesh of related topics?

• Node.js Interview Questions 2026 - event loop, streams, and module system fundamentals
• TypeScript Interview Questions 2026 - decorators, generics, and type safety in NestJS
• FastAPI Interview Questions 2026 - compare Python async framework patterns
• Spring Framework Interview Questions 2026 - compare Java DI/IoC patterns NestJS was inspired by