β ESSAY
I'm writing my fourth book. This time, it's about Node.js.
What happens to performance when V8's hidden classes break? How does AsyncLocalStorage track async/await chains? How does Prototype Pollution actually lead to RCE? β This book seeks to answer these questions at the code and source level.
I've currently completed Parts 1-5 out of 10 total parts, and I'm working on Parts 6-10. The content written so far is already about 65% of my previous book <<Web Performance Deep Dive>>, so I expect the completed version will be longer than my previous work.
| Part | Topic | Progress |
|---|---|---|
| Part 0 | Before We Begin | β |
| Part 1 | The Heart of Node.js Runtime β V8, libuv, Event Loop, Task Queue, Native Bindings | β |
| Part 2 | Module System β CommonJS, ESM, Dual Package Hazard, Custom Loaders | β |
| Part 3 | Memory and Streams β V8 GC, Buffer, Stream Backpressure, Web Streams | β |
| Part 4 | Networking β TCP/IP, HTTP Protocol Evolution, TLS/SSL, DNS, WebSocket | β |
| Part 5 | Security β Permission Model, vm Module, Prototype Pollution, Password/Token Validation | β |
| Part 6 | Concurrency β Worker Threads, AsyncLocalStorage, Child Process, Concurrency Control Patterns | β |
| Part 7 | Errors and Processes β Error Propagation, uncaughtException, Cluster, Signals, Graceful Shutdown | π§ |
| Part 8 | Performance Diagnostics β Event Loop Delay Measurement, CPU Profiling, Memory Leak Diagnosis, async_hooks, diagnostics_channel | π§ |
| Part 9 | Production Environment β Containers, Serverless, Edge Runtime | π§ |
The table of contents may change during the writing process.
With my previous book <<Web Performance Deep Dive>>, the beta reading period overlapped with the publication schedule, so I could only incorporate some of the valuable feedback I received. That was quite disappointing.
This time, I plan to carefully incorporate all feedback from beta readers before submitting the manuscript to the publisher. I don't want to let any opinions slip by due to schedule pressure. So I'd appreciate it if you could provide feedback across all chapters.
Eligibility: Any intermediate to advanced developer with Node.js experience. Years of experience don't matter.
How to Apply: Send an email to root@yceffort.kr with the subject line [Beta Reader Application].
I need to collect this information to introduce who the beta readers are. It won't be used for any other purpose.
Application Period: Open recruitment
Capacity: Maximum 10 people
Thank you ππ»ββοΈ
A preview of section 5.2 (Pitfalls of the vm Module) from the upcoming Node.js Deep Dive book.
A feature where the server opens a URL the user handed it has the textbook conditions for SSRF written into its spec. Six ways a whitelist gets bypassed first, then five defensive principles that block them, all actually run on Node. Strip IPv4-mapped by hand and it gets through in hex notation, undici lookup hook is never called when the host is an IP literal, and URL.hostname keeps the brackets on an IPv6 literal. The final post of a two-part design note on OG scraping servers.
The "10% error rate" of a link preview server is a single number that five different kinds of failure got mashed into. This post works out why this workload is I/O bound at that TPS, where runtime choice actually diverges across four points, and then moves on to lowering the error rate with User-Agent and encoding. Node built-in TextDecoder turns CP949 extension characters into different characters without raising an error, and a scraped og:title is not an API response but user input. It also covers cache stampedes, negative caching, and a two-million-run simulation that verifies "P95 under one second" by working backwards from the cache hit rate. The first post of a two-part design note on OG scraping servers.
In a Next.js 16 Turbopack production build, a module-scope singleton became two live instances at runtime. Inside the same synchronous block, one condition contradicted the other, and responses that arrived in 30ms still timed out. This is the record of tracing the cause through the bundle output: a partial scope hoisting merge, a circular import, an upstream bug that had already been fixed, and the single-variable experiment I ran too late.