What are some common security issues in a Node.js API and how do you defend against them?

Work through the layers rather than listing tools.

• Injection. Never build SQL by string concatenation — use parameterised queries or an ORM. For NoSQL, reject object-valued query parameters, which is how { $gt: '' } becomes an authentication bypass.
• Input validation. Validate and coerce every request body and query parameter against a schema at the edge, with something like Zod or Joi. Anything unvalidated eventually reaches a database or a shell.
• Authentication and sessions. Hash passwords with bcrypt or argon2, never a plain digest. Keep JWT lifetimes short, use refresh tokens, and store them in httpOnly, secure, sameSite cookies rather than localStorage.
• Rate limiting and payload limits. Cap request body size and rate limit authentication endpoints specifically, or you are shipping a credential-stuffing target.
• Headers and transport. Use helmet for sensible defaults, enforce HTTPS, and configure CORS to a real allowlist rather than *.
• Dependencies. npm audit in CI, lockfiles committed, and as few transitive dependencies as you can manage.
• Secrets. In environment variables or a secret manager, never in the repository.