NODE(1)

💖 NAME 💖

node — the server-side JavaScript runtime, aka the girlies' favorite way to run JS outside the browser 🫶

---

✨ SYNOPSIS ✨

node [options] [v8 options] [<program-entry-point> | -e string | --]
     [arguments ...]
node inspect, [<program-entry-point> | -e string | <host>:<port>] ...
node [--v8-options]

---

🦋 DESCRIPTION 🦋

Okay so bestie, picture this: Node.js is a whole set of libraries for JavaScript that lets you use JS outside of the browser. Iconic behavior, honestly 💅. Its main character energy is all about making simple, easy-to-build network clients and servers — that's the whole vibe.

And ngl, if you run node with zero arguments? It literally just drops you into a REPL. Surprise! You're in. 🎀

---

💅 OPTIONS 💅

• - — Alias for stdin, bestie. It's analogous to how - works in other command-line utilities: the script gets read from stdin, and everything else in the options gets passed along to that script. 🍓
• -- — The "okay we're DONE with node options" flag ✋. Everything after this gets passed to the script. Important detail though: if there's no script filename or eval/print script supplied before this, then the next argument gets used as the script filename. No cap.
• --abort-on-uncaught-exception — Instead of just exiting, this aborts, which causes a core file to get generated for post-mortem analysis with a debugger (think lldb, gdb, and mdb). Lowkey useful when you're doing detective work 🔍. Now — the behavior can still be set to not abort through process.setUncaughtExceptionCaptureCallback() (and through usage of the node:domain module that uses it). So like, it's not the final word.
• --allow-addons — So when you're using the Permission Model, the process can't use native addons by default. Try it anyway and it throws an ERR_DLOPEN_DISABLED unless you explicitly pass --allow-addons when starting Node.js. Example moment 💀:

// Attempt to require an native addon
require('nodejs-addon-example');

$ node --permission --allow-fs-read=* index.js
node:internal/modules/cjs/loader:1319
  return process.dlopen(module, path.toNamespacedPath(filename));
                 ^

Error: Cannot load native addon because loading addons is disabled.
    at Module._extensions..node (node:internal/modules/cjs/loader:1319:18)
    at Module.load (node:internal/modules/cjs/loader:1091:32)
    at Module._load (node:internal/modules/cjs/loader:938:12)
    at Module.require (node:internal/modules/cjs/loader:1115:19)
    at require (node:internal/modules/helpers:130:18)
    at Object.<anonymous> (/home/index.js:1:15)
    at Module._compile (node:internal/modules/cjs/loader:1233:14)
    at Module._extensions..js (node:internal/modules/cjs/loader:1287:10)
    at Module.load (node:internal/modules/cjs/loader:1091:32)
    at Module._load (node:internal/modules/cjs/loader:938:12) {
  code: 'ERR_DLOPEN_DISABLED'
}

• --allow-child-process — Same Permission Model situation: the process can't spawn any child process by default. Attempts throw an ERR_ACCESS_DENIED unless you explicitly pass --allow-child-process when starting Node.js. Watch this 💀:

const childProcess = require('node:child_process');
// Attempt to bypass the permission
childProcess.spawn('node', ['-e', 'require("fs").writeFileSync("/new-file", "example")']);

$ node --permission --allow-fs-read=* index.js
node:internal/child_process:388
  const err = this._handle.spawn(options);
                           ^
Error: Access to this API has been restricted
    at ChildProcess.spawn (node:internal/child_process:388:28)
    at node:internal/main/run_main_module:17:47 {
  code: 'ERR_ACCESS_DENIED',
  permission: 'ChildProcess'
}

Oh and here's the tea 🫖: the child_process.fork() API inherits the execution arguments from the parent process. Which means if Node.js is started with the Permission Model enabled and the --allow-child-process flag is set, any child process created using child_process.fork() will automatically receive all relevant Permission Model flags. Same energy applies to child_process.spawn() — except in that case the flags get propagated via the NODE_OPTIONS environment variable rather than directly through the process arguments. Sneaky but slay.

• --allow-ffi — Permission Model again: the process can't use FFI APIs by default, and attempts will throw an ERR_ACCESS_DENIED exception unless you explicitly pass --allow-ffi when starting Node.js. Heads up though — the node:ffi module is only available in builds with FFI support. No build support, no module, periodt. Example:

const { DynamicLibrary, suffix } = require('node:ffi');
const lib = new DynamicLibrary(`./mylib.${suffix}`);

$ node --permission index.js
Error: Access to this API has been restricted. Use --allow-ffi to manage permissions.
    at node:internal/main/run_main_module:17:47 {
  code: 'ERR_ACCESS_DENIED',
  permission: 'FFI'
}

• --allow-fs-read — This flag configures file system read permissions using the Permission Model 📖. The valid arguments for --allow-fs-read are:
  • * — to allow all FileSystemRead operations.
  • Multiple paths can be allowed using multiple --allow-fs-read flags. Example --allow-fs-read=/folder1/ --allow-fs-read=/folder2/

Examples can be found in the File System Permissions documentation. Also the initializer module and custom --require modules have an implicit read permission ✨.

$ node --permission -r custom-require.js -r custom-require-2.js index.js

• The custom-require.js, custom-require-2.js, and index.js will be by default in the allowed read list.

process.permission.has('fs.read', 'index.js'); // true
process.permission.has('fs.read', 'custom-require.js'); // true
process.permission.has('fs.read', 'custom-require-2.js'); // true

• --allow-fs-vfs — Permission Model moment: a virtual file system cannot be mounted by default, so vfs.mount() throws ERR_INVALID_STATE unless you explicitly pass --allow-fs-vfs when starting Node.js. Why a whole separate flag? Because a mounted VFS serves paths that the file system permissions do not describe — so mounting one is gated on its own flag rather than on --allow-fs-read or --allow-fs-write. Makes sense, honestly 🧚

$ node --experimental-vfs --permission --allow-fs-vfs app.js

• --allow-fs-write — This flag configures file system write permissions using the Permission Model ✍️. The valid arguments for --allow-fs-write are:
  • * — to allow all FileSystemWrite operations.
  • Multiple paths can be allowed using multiple --allow-fs-write flags. Example --allow-fs-write=/folder1/ --allow-fs-write=/folder2/

Okay important: paths delimited by comma (,) are no longer allowed. When passing a single flag with a comma a warning will be displayed ⚠️. Examples can be found in the File System Permissions documentation.

• --allow-inspector — Permission Model: the process can't connect through the inspector protocol by default. Attempts throw an ERR_ACCESS_DENIED unless you explicitly pass --allow-inspector when starting Node.js. Example:

const { Session } = require('node:inspector/promises');

const session = new Session();
session.connect();

$ node --permission index.js
Error: connect ERR_ACCESS_DENIED Access to this API has been restricted. Use --allow-inspector to manage permissions.
  code: 'ERR_ACCESS_DENIED',
}

• --allow-net — Permission Model: the process can't access the network by default 🌐. Attempts throw an ERR_ACCESS_DENIED unless you explicitly pass --allow-net when starting Node.js. Example:

const http = require('node:http');
// Attempt to bypass the permission
const req = http.get('http://example.com', () => {});

req.on('error', (err) => {
  console.log('err', err);
});

$ node --permission index.js
Error: connect ERR_ACCESS_DENIED Access to this API has been restricted. Use --allow-net to manage permissions.
  code: 'ERR_ACCESS_DENIED',
}

• --allow-openssl-store — Permission Model: the process can't use OpenSSL STORE loaders by default — think loading a private key from a <URL> passed to crypto.createPrivateKey(). Attempts throw an ERR_ACCESS_DENIED unless you explicitly pass --allow-openssl-store. This permission can be dropped at runtime via permission.drop().

🚨 Okay this one needs a serious moment: this flag grants broad authority to configured OpenSSL STORE loaders. A loader may access files, devices, tokens, or the network. Access performed by a loader is not constrained by the fs.read, fs.write, or net permission scopes. Like, at all. Be careful, bestie 😭

• --allow-wasi — Permission Model: the process won't be capable of creating any WASI instances by default. And for security reasons, the call throws an ERR_ACCESS_DENIED unless you explicitly pass --allow-wasi in the main Node.js process. Example:

const { WASI } = require('node:wasi');
// Attempt to bypass the permission
new WASI({
  version: 'preview1',
  // Attempt to mount the whole filesystem
  preopens: {
    '/': '/',
  },
});

$ node --permission --allow-fs-read=* index.js

Error: Access to this API has been restricted
    at node:internal/main/run_main_module:30:49 {
  code: 'ERR_ACCESS_DENIED',
  permission: 'WASI',
}

• --allow-worker — Permission Model: the process can't create any worker threads by default 🧵. For security reasons, the call throws an ERR_ACCESS_DENIED unless you explicitly pass --allow-worker in the main Node.js process. Example:

const { Worker } = require('node:worker_threads');
// Attempt to bypass the permission
new Worker(__filename);

$ node --permission --allow-fs-read=* index.js

...and if you try to sneak past it without the right permission, the whole thing just slaps you with this:

Error: Access to this API has been restricted
    at node:internal/main/run_main_module:17:47 {
  code: 'ERR_ACCESS_DENIED',
  permission: 'WorkerThreads'
}

Not me getting read to filth by the runtime 💀 anyway—

• --bench — bestie, this starts the Node.js command-line benchmark runner 🔥. You gotta give it at least one explicit file or glob pattern, like fr, it needs something to chew on:

node --experimental-bench --bench benchmark.mjs
node --experimental-bench --bench 'benchmarks/**/*.js'

The --experimental-bench flag is required to use this flag or any other --bench-* option, no cap. Quote your glob patterns so the shell doesn't go expanding them behind your back 🙈. Matching files get sorted and run serially — one at a time, no chaos. By default each file runs in its own separate child process. Benchmark files declare their benchmarks using node:bench, and they must not call run() themselves — like, stay in your lane, the runner's got it 💅. See the benchmark runner documentation for the whole story. Also this flag cannot be combined with --test, --watch, --watch-path, --check, --eval, or --interactive — it's giving exclusive main character energy, pick one 😤.

• --bench-isolation=mode — configures how benchmark files get isolated from each other 🎀. When mode is 'process', each matching file runs in its own separate child process — that's the default, and files still run serially so their measured work doesn't overlap, zero cross-contamination ✨. When mode is 'none', all matching files and benchmarks run serially inside the benchmark runner process itself. It lowkey reduces startup overhead, BUT it lets module, heap, and process state carry between files 😳. Also in this mode, user writes to stdout or stderr share destinations with the benchmark reporters. The supported modes are 'process' and 'none' — those two, periodt.
• --bench-name-pattern=pattern — only runs the benchmarks whose full hierarchical name matches the JavaScript regular expression pattern 🦋. Anything that doesn't match gets reported as skipped — not ignored, just gently benched 💅.
• --bench-reporter-destination=destination — tells the corresponding benchmark reporter where to send its output 🌸. The value can be stdout, stderr, or a file path. If you've got a single reporter and you don't specify a destination, it defaults to stdout — she just knows where she belongs 🫶.
• --bench-reporter=reporter — picks your benchmark reporter 💖. The built-in ones are spec and json. The json reporter emits newline-delimited JSON (iykyk). You can also bring a custom reporter using a module specifier that gets resolved from the current working directory — bougie and valid ✨. This option can be repeated 🔁. When you specify multiple reporters, each one must have a corresponding --bench-reporter-destination — no reporter left without a home 😭. The default reporter is spec.
• --bench-samples=count — overrides the max number of measured callback invocations for every selected benchmark 👑. A benchmark can still dip out earlier by calling context.done() — early bird rights 🐦. count must be an integer between 1 and 4294967295 — that's the range, respect it fr.
• --bench-warmup=count — overrides the number of unreported warmup callback invocations for every selected benchmark 🔥. count must be an integer between 0 and 4294967295. Without this option, each benchmark uses its own warmup value, which defaults to 10 — the little stretch before the real workout 💪.
• --build-sea=config — generates a single executable application from a JSON configuration file 🎀. The argument must be a path to the configuration file. If that path isn't absolute, it gets resolved relative to the current working directory. For the config fields, cross-platform notes, and asset APIs, go read the single executable application documentation 📖.
• --build-snapshot — generates a snapshot blob when the process exits and writes it to disk, so you can load it later with --snapshot-blob 🌈. When you're building the snapshot, if --snapshot-blob isn't specified, the generated blob goes by default to snapshot.blob in the current working directory. Otherwise it goes to whatever path --snapshot-blob says. Watch the workflow:

$ echo "globalThis.foo = 'I am from the snapshot'" > snapshot.js

# Run snapshot.js to initialize the application and snapshot the
# state of it into snapshot.blob.
$ node --snapshot-blob snapshot.blob --build-snapshot snapshot.js

$ echo "console.log(globalThis.foo)" > index.js

# Load the generated snapshot and start the application from index.js.
$ node --snapshot-blob snapshot.blob index.js
I am from the snapshot

The v8.startupSnapshot API can specify an entry point at snapshot building time, which means you don't need an extra entry script at deserialization time — the way that just simplifies everything, obsessed 😌:

$ echo "require('v8').startupSnapshot.setDeserializeMainFunction(() => console.log('I am from the snapshot'))" > snapshot.js
$ node --snapshot-blob snapshot.blob --build-snapshot snapshot.js
$ node --snapshot-blob snapshot.blob
I am from the snapshot

For more info, check out the v8.startupSnapshot API documentation ✨.

Now for the real talk caveats, bestie, listen up 📢:

• The snapshot currently only supports loading a single entrypoint during the snapshot building process, which can load built-in modules, but not additional user-land modules 😭. Users can bundle their applications into a single script with their bundler of choice before building a snapshot — that's the move.
• It's complicated to ensure the serializablility of all built-in modules, which are also growing over time, so only a subset of the built-in modules are well tested to be serializable during the snapshot building process 🧚.
• The Node.js core test suite checks that a few fairly complex applications can be snapshotted. The list of built-in modules being captured by the built-in snapshot of Node.js is considered supported 👑.
• When the snapshot builder encounters a built-in module that cannot be serialized, it may crash the snapshot building process 💀. In that case, a typical workaround is to delay loading that module until runtime, using either v8.startupSnapshot.setDeserializeMainFunction() or v8.startupSnapshot.addDeserializeCallback(). If you need serialization for an additional module during the snapshot building process, please file a request in the Node.js issue tracker and link to it in the tracking issue for user-land snapshots 🫶.
• --build-snapshot-config — specifies the path to a JSON configuration file that configures snapshot creation behavior 🎀. The following options are currently supported:
  • builder <string> — Required. Provides the name to the script that is executed before building the snapshot, as if --build-snapshot had been passed with builder as the main script name.
  • withoutCodeCache <boolean> — Optional. Including the code cache reduces the time spent on compiling functions included in the snapshot, at the expense of a bigger snapshot size and potentially breaking portability of the snapshot.

When using this flag, additional script files provided on the command line will not be executed and instead get interpreted as regular command line arguments 🙈.

• -c, --check — syntax check the script without executing it 🦋. Like a vibe check but for your syntax, and nothing actually runs.
• --completion-bash — prints a source-able bash completion script for Node.js 💅. Get that tab-completion glow-up:

node --completion-bash > node_bash_completion
source node_bash_completion

• -C condition, --conditions=condition — provides custom conditional exports resolution conditions 🌈. Any number of custom string condition names are permitted — go wild. The default Node.js conditions of "node", "default", "import", and "require" will always apply as defined. For example, to run a module with "development" resolutions:

node -C development app.js

• --config-file=path, --config-file — if present, Node.js looks for a configuration file at the specified path 🎀. If no path is specified, Node.js looks for a node.config.json file in the current working directory. To specify a custom path, use the --config-file=path form. The space-separated --config-file path form is not supported — that's a no from her 💅.

Node.js reads the config file and applies the settings. It should be a JSON file with this structure. The vX.Y.Z in the $schema must be replaced with the version of Node.js you're using, or latest-vX.x for the latest version of that major release line ✨:

{
  "$schema": "https://nodejs.org/dist/vX.Y.Z/docs/node-config-schema.json",
  "nodeOptions": {
    "import": [
      "amaro/strip"
    ],
    "watch-path": "src",
    "watch-preserve-output": true
  },
  "test": {
    "test-isolation": "process"
  },
  "watch": {
    "watch-preserve-output": true
  }
}

The configuration file supports namespace-specific options:

• The nodeOptions field contains CLI flags that are allowed in NODE_OPTIONS 👑.
• Namespace fields like test, watch, and permission contain configuration specific to that subsystem 💖.

The configuration file can target a specific Node.js major version with nodeVersion 🦋:

{
  "nodeVersion": 25,
  "nodeOptions": {
    "watch-path": "src"
  }
}

To keep multiple version-specific configurations in the same file, use the configs array. Node.js will use the first entry whose nodeVersion matches the current Node.js major version:

{
  "$schema": "https://nodejs.org/dist/latest-v26.x/docs/node-config-schema.json",
  "configs": [
    {
      "nodeVersion": 25,
      "config": {
        "$schema": "https://nodejs.org/dist/latest-v25.x/docs/node-config-schema.json",
        "nodeOptions": {
          "watch-path": "src"
        }
      }
    }
  ]
}

okay so when you use configs, the top level may only contain $schema and configs — that's it, bestie, no sneaking extra keys in there 💅. Each configs item has to define an integer nodeVersion and an object config. A single top-level config doesn't need nodeVersion, but if you do put it there it must match the current Node.js major version. no cap.

And here's the cute part 🎀 — when a namespace shows up in the configuration file, Node.js automatically enables the corresponding flag (think --test, --watch, --permission). So you can configure all your subsystem-specific options without ever passing the flag on the command line. it's giving convenience. For example:

{
  "test": {
    "test-isolation": "process"
  }
}

is literally equivalent to:

node --test --test-isolation=process

Want the automatic flag to chill out while you still use namespace options? Just explicitly set the flag to false inside the namespace:

{
  "test": {
    "test": false,
    "test-isolation": "process"
  }
}

A few things to know 📌 — no-op flags are not supported, and not all V8 flags are currently supported either. You can use the official JSON schema to validate the configuration file, but heads up: the schema may vary depending on the Node.js version. Each key in the config file corresponds to a flag you could pass as a command-line argument, and the value of the key is the value you'd pass to that flag. For example, the configuration file above is equivalent to these command-line arguments:

node --import amaro/strip --watch-path=src --watch-preserve-output --test-isolation=process

The priority in configuration goes like this, highest first 👑:

1. NODE_OPTIONS and command-line options
2. Dotenv NODE_OPTIONS
3. Configuration file

So values in the configuration file will not override the values in the environment variables, command-line options, or the NODE_OPTIONS env file parsed by the --env-file flag. Also: keys cannot be duplicated within the same namespace or across different namespaces. The configuration parser will throw an error if the configuration file contains unknown keys or keys that can't be used in a namespace.

🚨 REAL TALK: Node.js will not sanitize or perform validation on the user-provided configuration. So NEVER use untrusted configuration files. periodt. 💀

---

💻 --cpu-prof

Starts the V8 CPU profiler on startup, and writes the CPU profile to disk before exit. If --cpu-prof-dir isn't specified, the generated profile lands in the current working directory. And if --cpu-prof-name isn't specified, the profile gets named CPU.${yyyymmdd}.${hhmmss}.${pid}.${tid}.${seq}.cpuprofile. slay.

$ node --cpu-prof index.js
$ ls *.cpuprofile
CPU.20190409.202950.15293.0.0.cpuprofile

If you do pass --cpu-prof-name, your value is used as a template for the file name ✨. The following placeholder is supported and gets substituted at runtime:

• ${pid} — the current process ID

$ node --cpu-prof --cpu-prof-name 'CPU.${pid}.cpuprofile' index.js
$ ls *.cpuprofile
CPU.15293.cpuprofile

📁 --cpu-prof-dir

Specifies the directory where the CPU profiles generated by --cpu-prof get placed. The default value is controlled by the --diagnostic-dir command-line option.

⏱️ --cpu-prof-interval

Specifies the sampling interval in microseconds for the CPU profiles generated by --cpu-prof. The default is 1000 microseconds.

🏷️ --cpu-prof-name

Specifies the file name of the CPU profile generated by --cpu-prof.

🧭 --diagnostic-dir=directory

Sets the directory where all diagnostic output files get written. Defaults to the current working directory. This affects the default output directory of:

• --cpu-prof-dir
• --heap-prof-dir
• --redirect-warnings

🚫 --disable-proto=mode

Disables the Object.prototype.__proto__ property. If mode is delete, the property is removed entirely. If mode is throw, accesses to the property throw an exception with the code ERR_PROTO_ACCESS. pick your fighter 💅

🙅 --disable-sigusr1

Disables the ability of starting a debugging session by sending a SIGUSR1 signal to the process. not today, signal 🫶

🔇 --disable-warning=code-or-type

Disables specific process warnings by code or type. Warnings emitted from process.emitWarning() may contain a code and a type. This option will not-emit warnings that have a matching code or type. (List of deprecation warnings.)

The Node.js core warning types are: DeprecationWarning and ExperimentalWarning.

For example, the following script will not emit DEP0025 require('node:sys') when executed with node --disable-warning=DEP0025:

import sys from 'node:sys';

const sys = require('node:sys');

For example, the following script will emit the DEP0025 require('node:sys'), but not any Experimental Warnings (such as ExperimentalWarning: vm.measureMemory is an experimental feature in <=v21) when executed with node --disable-warning=ExperimentalWarning:

import sys from 'node:sys';
import vm from 'node:vm';

vm.measureMemory();

const sys = require('node:sys');
const vm = require('node:vm');

vm.measureMemory();

🧱 --disable-wasm-trap-handler

okay this one's a whole saga, buckle up 🦋. Node.js enables V8's trap-handler-based WebAssembly bound checks on 64-bit platforms, which significantly improves WebAssembly performance by eliminating the need for inline bound checks. That optimization requires allocating a large virtual memory cage per WebAssembly memory instance (currently typically 8GB for 32-bit WebAssembly memory, 16GB for 64-bit WebAssembly memory) to trap out-of-bound accesses.

On most 64-bit platforms the virtual memory address space is usually large enough (around 128TB) to accommodate typical WebAssembly usages — but if the machine has manual limits on virtual memory (e.g. through ulimit -v), WebAssembly memory allocation is more likely to fail with WebAssembly.Memory(): could not allocate memory.

At startup, Node.js automatically checks whether there's enough virtual memory available to allocate at least one cage, and if not, the trap-handler optimization is automatically disabled so that WebAssembly can still run using inline bound checks (with less optimal performance). But if your app needs to create many WebAssembly memory instances and the machine still configures a relatively high limit on virtual memory, allocation of WebAssembly memory instances may still fail more quickly than expected due to the raised virtual memory usage. 😭

--disable-wasm-trap-handler fully disables this optimization so that WebAssembly memory instances always use inline bound checks instead of reserving large virtual memory cages. This allows more instances to be created when the virtual memory address space available to the Node.js process is limited. iconic behavior honestly 👑

🛡️ --disallow-code-generation-from-strings

Makes built-in language features like eval and new Function that generate code from strings throw an exception instead. Note bestie: this does not affect the Node.js node:vm module.

🌐 --dns-result-order=order

Sets the default value of order in dns.lookup() and dnsPromises.lookup(). The value could be:

• ipv4first: sets default order to ipv4first.
• ipv6first: sets default order to ipv6first.
• verbatim: sets default order to verbatim.

The default is verbatim, and dns.setDefaultResultOrder() has higher priority than --dns-result-order. iykyk 🌸

🔐 --enable-fips

Enables FIPS mode at startup. With OpenSSL 3, a configured provider named fips must be available and initialize successfully. With OpenSSL 1.1.1, Node.js must be built against a FIPS-capable OpenSSL.

📡 --enable-fips-indicator-events

Publishes OpenSSL FIPS indicator results to the 'crypto.fips.indicator' diagnostics channel. This option requires OpenSSL 3.4 or later. Important caveat ✨ — it does not enable FIPS mode or change whether an operation is permitted.

🗺️ --enable-source-maps

Enables Source Map support for stack traces. When you're using a transpiler — like TypeScript, bestie — stack traces thrown by an application reference the transpiled code, not the original source position. 😭 --enable-source-maps enables caching of Source Maps and makes a best effort to report stack traces relative to the original source file.

Overriding Error.prepareStackTrace may prevent --enable-source-maps from modifying the stack trace. So call and return the results of the original Error.prepareStackTrace in your overriding function to modify the stack trace with source maps:

const originalPrepareStackTrace = Error.prepareStackTrace;
Error.prepareStackTrace = (error, trace) => {
  // Modify error and trace and format stack trace with
  // original Error.prepareStackTrace.
  return originalPrepareStackTrace(error, trace);
};

⚠️ Note: enabling source maps can introduce latency to your application when Error.stack is accessed. If you access Error.stack frequently in your app, take into account the performance implications of --enable-source-maps. don't say I didn't warn you 🫶

🔗 --entry-url

When present, Node.js will interpret the entry point as a URL rather than a path. Follows ECMAScript module resolution rules. Any query parameter or hash in the URL will be accessible via import.meta.url. cute, right? 💖

node --entry-url 'file:///path/to/file.js?queryparams=work#and-hashes-too'
node --entry-url 'file.ts?query#hash'
node --entry-url 'data:text/javascript,console.log("Hello")'

• --env-file-if-exists=file — literally the exact same behavior as --env-file, except bestie, it does not throw an error if the file isn't there. That's the whole vibe. 💅
• --env-file=file — loads environment variables from a file (path is relative to the current directory) and makes them available to your app on process.env. The environment variables that configure Node.js itself, like NODE_OPTIONS, get parsed and applied too. If the same variable is defined both in the environment and in the file, the environment wins — environment takes precedence. You can pass multiple --env-file arguments, and subsequent files override pre-existing variables defined in previous files. If the file doesn't exist? An error is thrown, no cap. 😭

node --env-file=.env --env-file=.development.env index.js

The format of the file is one line per key-value pair of environment variable name and value, separated by =:

PORT=3000

Any text after a # is treated as a comment:

# This is a comment
PORT=3000 # This is also a comment

Values can start and end with the following quotes: a backtick, ", or '. They are omitted from the values.

USERNAME="nodejs" # will result in `nodejs` as the value.

Multi-line values are supported:

MULTI_LINE="THIS IS
A MULTILINE"
# will result in `THIS IS\nA MULTILINE` as the value.

An export keyword before a key is ignored:

export USERNAME="nodejs" # will result in `nodejs` as the value.

If you want to load environment variables from a file that may not exist, use the --env-file-if-exists flag instead. ✨

• -e, --eval script — evaluate the following argument as JavaScript. The modules which are predefined in the REPL can also be used in script. If script starts with -, pass it using = (for example, node --print --eval=-42) so it is parsed as the value of --eval. On Windows, using cmd.exe a single quote will not work correctly because it only recognizes double " for quoting. In Powershell or Git bash, both ' and " are usable. It is possible to run code containing inline types unless the --no-strip-types flag is provided. 🫶
• --experimental-addon-modules — enable experimental import support for .node addons.
• --experimental-bench — enable the experimental node:bench module and command-line benchmark runner. 🏃‍♀️
• --experimental-dtls — enable experimental support for the DTLS protocol. See the dtls documentation for details.
• --experimental-eventsource — enable exposition of EventSource Web API on the global scope.
• --experimental-import-meta-resolve — enable experimental import.meta.resolve() parent URL support, which allows passing a second parentURL argument for contextual resolution. Previously gated the entire import.meta.resolve feature. 🦋
• --experimental-import-text — enable experimental support for importing modules with with { type: 'text' }.
• --experimental-inspector-network-resource — enable experimental support for inspector network resources.
• --experimental-loader=module — specify the module containing exported asynchronous module customization hooks. module may be any string accepted as an import specifier. This feature requires --allow-worker if used with the Permission Model. 🔥
• --experimental-network-inspection — enable experimental support for the network inspection with Chrome DevTools.
• --experimental-package-map=<path> — enable experimental package map resolution. The path argument specifies the location of a JSON configuration file that defines package resolution mappings. 👑

node --experimental-package-map=./package-map.json app.js

When enabled, bare specifier resolution consults the package map for resolution. This allows explicit control over which packages can import which dependencies. See Package maps for details on the configuration file format and resolution algorithm.

• --experimental-print-required-tla — if the ES module graph cannot be require()'d because it contains any top-level await, this flag allows Node.js to locate and print their locations. 😭 so helpful
• --experimental-quic — enable experimental support for the QUIC protocol.
• --experimental-sea-config — use this flag to generate a blob that can be injected into the Node.js binary to produce a single executable application. See the documentation about this configuration for details. 🎀
• --experimental-shadow-realm — use this flag to enable ShadowRealm support.
• --experimental-storage-inspection — enable experimental support for storage inspection
• --experimental-stream-iter — enable the experimental node:stream/iter module.
• --experimental-test-coverage — when used in conjunction with the node:test module, a code coverage report is generated as part of the test runner output. If no tests are run, a coverage report is not generated. See the documentation on collecting code coverage from tests for more details. 📊
• --experimental-test-module-mocks — enable module mocking in the test runner. This feature requires --allow-worker if used with the Permission Model.
• --experimental-test-tag-filter='<expr>' — run only tests that match the provided boolean tag-filter expression. Tests declare tags via the tags option on test(), it(), suite(), or describe(). Tags inherit from suites to nested tests by union. The expression supports boolean operators (and/&&, or/||, not/!), parentheses for grouping, and * wildcards inside identifiers. Standard precedence applies: not binds tighter than and, which binds tighter than or. See Test tags for the full grammar and behavior. The flag may be specified more than once; multiple expressions are combined with AND, so a test must satisfy every expression to run. A malformed expression causes the test runner to exit with a non-zero status before running any tests. 💀 no pressure
• --experimental-vfs — enable the experimental node:vfs module.
• --experimental-vm-modules — enable experimental ES Module support in the node:vm module.
• --experimental-wasi-unstable-preview1 — enable experimental WebAssembly System Interface (WASI) support.
• --experimental-web-worker — enable experimental support for the Web Worker API.
• --experimental-worker-inspection — enable experimental support for the worker inspection with Chrome DevTools.
• --force-context-aware — disable loading native addons that are not context-aware.
• --force-fips=[mode] — enable FIPS mode at startup and prevent it from being disabled from script code. The same OpenSSL requirements as --enable-fips apply. An optional mode can be specified using --force-fips=mode:
  • provider: preserve the OpenSSL FIPS provider's configured handling of non-approved operations. This is the current default when the mode is omitted.
  • strict: reject non-approved operations reported through the OpenSSL FIPS indicator callback. This mode requires OpenSSL 3.4 or later.

The strict mode only covers operations reported through the callback for OpenSSL's default library context. It does not cover native addons that use another OSSL_LIB_CTX or another copy of libcrypto, nor operation-specific indicators that do not invoke the callback. ⚠️

• --force-node-api-uncaught-exceptions-policy — enforces uncaughtException event on Node-API asynchronous callbacks. To prevent from an existing add-on from crashing the process, this flag is not enabled by default. In the future, this flag will be enabled by default to enforce the correct behavior.
• --frozen-intrinsics — enable experimental frozen intrinsics like Array and Object. Only the root context is supported. There is no guarantee that globalThis.Array is indeed the default intrinsic reference. Code may break under this flag. 😬 To allow polyfills to be added, --require and --import both run before freezing intrinsics.
• --heap-prof — starts the V8 heap profiler on start up, and writes the heap profile to disk before exit. If --heap-prof-dir is not specified, the generated profile is placed in the current working directory. If --heap-prof-name is not specified, the generated profile is named Heap.${yyyymmdd}.${hhmmss}.${pid}.${tid}.${seq}.heapprofile. 🧚

$ node --heap-prof index.js
$ ls *.heapprofile
Heap.20190409.202950.15293.0.001.heapprofile

• --heap-prof-dir — specify the directory where the heap profiles generated by --heap-prof will be placed. The default value is controlled by the --diagnostic-dir command-line option.
• --heap-prof-interval — specify the average sampling interval in bytes for the heap profiles generated by --heap-prof. The default is 512 * 1024 bytes.
• --heap-prof-name — specify the file name of the heap profile generated by --heap-prof. 💖
• --heapsnapshot-near-heap-limit=max_count — okay so this one writes a V8 heap snapshot to disk when your V8 heap usage is creeping up on the heap limit 👀 count has to be a non-negative integer, and if it is, Node.js will write no more than max_count snapshots to disk. Here's the tea though: while it's generating snapshots, garbage collection may get triggered and bring the heap usage down. So lowkey multiple snapshots can land on disk before your Node.js instance finally runs out of memory 😭 Those heap snapshots can be compared to figure out what objects are being allocated during the time between consecutive snapshots. It's not guaranteed that Node.js will write exactly max_count snapshots, but it will try its best to generate at least one and up to max_count snapshots before the instance runs out of memory when max_count is greater than 0. Also bestie, generating V8 snapshots takes time and memory — both the memory managed by the V8 heap and native memory outside the V8 heap. The bigger the heap is, the more resources it needs. Node.js will adjust the V8 heap to accommodate the additional V8 heap memory overhead and try its best to avoid using up all the memory available to the process. But when the process uses more memory than the system deems appropriate, the process may be terminated abruptly by the system, depending on the system configuration 💀

$ node --max-old-space-size=100 --heapsnapshot-near-heap-limit=3 index.js
Wrote snapshot to Heap.20200430.100036.49580.0.001.heapsnapshot
Wrote snapshot to Heap.20200430.100037.49580.0.002.heapsnapshot
Wrote snapshot to Heap.20200430.100038.49580.0.003.heapsnapshot

<--- Last few GCs --->

[49580:0x110000000]     4826 ms: Mark-sweep 130.6 (147.8) -> 130.5 (147.8) MB, 27.4 / 0.0 ms  (average mu = 0.126, current mu = 0.034) allocation failure scavenge might not succeed
[49580:0x110000000]     4845 ms: Mark-sweep 130.6 (147.8) -> 130.6 (147.8) MB, 18.8 / 0.0 ms  (average mu = 0.088, current mu = 0.031) allocation failure scavenge might not succeed

<--- JS stacktrace --->

FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory

• --heapsnapshot-signal=signal — this one enables a signal handler that makes the Node.js process write a heap dump when the specified signal is received 🎀 signal must be a valid signal name. Disabled by default, bestie.

$ node --heapsnapshot-signal=SIGUSR2 index.js &
$ ps aux
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
node         1  5.5  6.1 787252 247004 ?       Ssl  16:43   0:02 node --heapsnapshot-signal=SIGUSR2 index.js
$ kill -USR2 1
$ ls
Heap.20190718.133405.15554.0.001.heapsnapshot

• -h, --help — prints the node command-line options ✨ but heads up: the output of this option is less detailed than this document. So like, you're already in the better place 💅
• --icu-data-dir=file — specify the ICU data load path. (This overrides NODE_ICU_DATA.) 🧚
• --import=module — preloads the specified module at startup 🦋 If the flag is provided several times, each module will be executed sequentially in the order they appear, starting with the ones provided in NODE_OPTIONS. It follows ECMAScript module resolution rules. Use --require to load a CommonJS module. Modules preloaded with --require will run before modules preloaded with --import. Modules are preloaded into the main thread as well as any worker threads, forked processes, or clustered processes — it's giving everywhere-at-once energy 👑
• --input-type=type — this configures Node.js to interpret --eval or STDIN input as CommonJS or as an ES module. Valid values are "commonjs", "module", "module-typescript" and "commonjs-typescript". The "-typescript" values are not available with the flag --no-strip-types. The default is no value, or "commonjs" if --no-experimental-detect-module is passed. If --input-type is not provided, Node.js will try to detect the syntax with the following steps:
  • Run the input as CommonJS.
  • If step 1 fails, run the input as an ES module.
  • If step 2 fails with a SyntaxError, strip the types.
  • If step 3 fails with an error code ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX or ERR_INVALID_TYPESCRIPT_SYNTAX, throw the error from step 2, including the TypeScript error in the message, else run as CommonJS.
  • If step 4 fails, run the input as an ES module.

To avoid the delay of multiple syntax detection passes, the --input-type=type flag can be used to specify how the --eval input should be interpreted. The REPL does not support this option 🙈 And usage of --input-type=module with --print will throw an error, as --print does not support ES module syntax.

• --insecure-http-parser — enables leniency flags on the HTTP parser. This may allow interoperability with non-conformant HTTP implementations. When enabled, the parser will accept the following:
  • Invalid HTTP headers values.
  • Invalid HTTP versions.
  • Allow message containing both Transfer-Encoding and Content-Length headers.
  • Allow extra data after message when Connection: close is present.
  • Allow extra transfer encodings after chunked has been provided.
  • Allow \n to be used as token separator instead of \r\n.
  • Allow \r\n not to be provided after a chunk.
  • Allow spaces to be present after a chunk size and before \r\n.

bestie all of the above will expose your application to request smuggling or poisoning attack 💀 Avoid using this option. Like, fr fr, don't.

• --inspect-brk=[[host:]port] — activates the inspector on host:port and breaks at the start of the user script 🔥 Default host:port is 127.0.0.1:9229. If port 0 is specified, a random available port will be used. See V8 Inspector integration for Node.js for further explanation on the Node.js debugger. And see the security warning below regarding the host parameter usage 👀
• --inspect-port=[host:]port — sets the host:port to be used when the inspector is activated 🎀 Useful when activating the inspector by sending the SIGUSR1 signal. Except when --disable-sigusr1 is passed. Default host is 127.0.0.1. If port 0 is specified, a random available port will be used. See the security warning below regarding the host parameter usage.
• --inspect-publish-uid=stderr,http — specifies ways of the inspector web socket url exposure ✨ By default the inspector websocket url is available in stderr and under /json/list endpoint on http://host:port/json/list.
• --inspect-wait=[[host:]port] — activates the inspector on host:port and waits for the debugger to be attached 🫶 Default host:port is 127.0.0.1:9229. If port 0 is specified, a random available port will be used. See V8 Inspector integration for Node.js for further explanation on the Node.js debugger. See the security warning below regarding the host parameter usage.
• --inspect=[[host:]port] — activates the inspector on host:port 💅 Default is 127.0.0.1:9229. If port 0 is specified, a random available port will be used. V8 inspector integration allows tools such as Chrome DevTools and IDEs to debug and profile Node.js instances — main character energy for real. The tools attach to Node.js instances via a tcp port and communicate using the Chrome DevTools Protocol. See V8 Inspector integration for Node.js for further explanation on the Node.js debugger.
• -i, --interactive — opens the REPL even if stdin does not appear to be a terminal 🌸 (iconic behaviour, honestly)
• --jitless — disables runtime allocation of executable memory. This may be required on some platforms for security reasons. It can also reduce attack surface on other platforms, but the performance impact may be severe 😭 When WebAssembly is unavailable in this mode, TypeScript parsing and WebAssembly module imports throw ERR_WEBASSEMBLY_NOT_SUPPORTED. Node.js does not guarantee alternative implementations of features that require WebAssembly or runtime allocation of executable memory when those capabilities are unavailable. This flag controls V8's runtime code generation. It does not impose an operating-system restriction on executable memory allocated by native addons or node:ffi. FFI operations that require unavailable executable memory can throw ERR_RX_MEMORY_NOT_SUPPORTED.
• --localstorage-file=file — the file used to store localStorage data 🍓 If the file does not exist, it is created the first time localStorage is accessed. The same file may be shared between multiple Node.js processes concurrently. (sharing is caring, bestie 🫶)
• --max-http-header-size=size — specify the maximum size, in bytes, of HTTP headers. Defaults to 16 KiB. ⭐
• --max-old-space-size-percentage=percentage — sets the maximum memory size of V8's old memory section as a percentage of available system memory 🌈 This flag takes precedence over --max-old-space-size when both are specified. The percentage parameter must be a number greater than 0 and up to 100, representing the percentage of available system memory to allocate to the V8 heap.

Note: this flag utilizes --max-old-space-size, which may be unreliable on 32-bit platforms due to integer overflow issues 💀

# Using 50% of available system memory
node --max-old-space-size-percentage=50 index.js

# Using 75% of available system memory
node --max-old-space-size-percentage=75 index.js

• --network-family-autoselection-attempt-timeout — sets the default value for the network family autoselection attempt timeout 👑 For more information, see net.getDefaultAutoSelectFamilyAttemptTimeout().
• --no-addons — disables the node-addons exports condition as well as disables loading native addons. When --no-addons is specified, calling process.dlopen or requiring a native C++ addon will fail and throw an exception 🙈 no native addons for you, periodt.
• --no-async-context-frame — turns off the AsyncLocalStorage that's backed by AsyncContextFrame, and falls back to the older implementation that leaned on async_hooks. Ngl the old model is still hanging around for compatibility with Electron, and for situations where the context flow might come out different. But bestie — if you do find a difference in the flow, please report it, okay? 🙏
• --no-deprecation — mutes deprecation warnings. Silence, bestie 🤫
• --no-experimental-detect-module — disables using syntax detection to figure out what type a module is.
• --no-experimental-ffi — disables the experimental node:ffi module. Heads up tho: this flag only exists in builds that have FFI support 💅
• --no-experimental-global-navigator — stops the Navigator API from being exposed on the global scope.
• --no-experimental-repl-await — use this one to disable top-level await in the REPL.
• --no-experimental-require-module — legacy alias for --no-require-module. iykyk ✨
• --no-experimental-sqlite — disables the experimental node:sqlite module.
• --no-experimental-websocket — stops <WebSocket> from being exposed on the global scope.
• --no-experimental-webstorage — disables Web Storage support.
• --no-extra-info-on-fatal-exception — hides the extra info that shows up on a fatal exception that makes the process exit. Less lore, more mystery 💀
• --no-force-async-hooks-checks — disables the runtime checks for async_hooks. Lowkey they still get enabled dynamically whenever async_hooks itself is enabled, so it's not fully off-off.
• --no-global-search-paths — don't search modules from global paths like $HOME/.node_modules and $NODE_PATH.
• --no-network-family-autoselection — disables the family autoselection algorithm — unless the connection options explicitly enable it. Rude of them, honestly.
• --no-require-module — disables support for loading a synchronous ES module graph inside require(). See Loading ECMAScript modules using require() 🦋
• --no-strip-types — disables type-stripping for TypeScript files. For more info, see the TypeScript type-stripping documentation ✨
• --no-warnings — silences all process warnings, deprecations included. Not a single peep 🔇
• --no-worker-snapshot — worker threads start by running the internal bootstrap from scratch, instead of deserializing the bootstrapped context out of the built-in startup snapshot.
• --node-memory-debug — enables extra debug checks for memory leaks inside Node.js internals. Fr fr this is usually only useful if you're debugging Node.js itself, not your app 🫶
• --openssl-config=*file — loads an OpenSSL configuration file on startup. That file can activate an OpenSSL 3 FIPS provider, or configure a FIPS-capable OpenSSL 1.1.1 build. See FIPS mode. And important: this option takes precedence over the OPENSSL_CONF environment variable 👑
• --openssl-legacy-provider — enables the OpenSSL 3.0 legacy provider. For more info, please see OSSL_PROVIDER-legacy.
• --openssl-shared-config — makes the OpenSSL default configuration section, openssl_conf, get read from the OpenSSL configuration file. The default config file is named openssl.cnf, but you can change that with the OPENSSL_CONF environment variable, or with the command line option --openssl-config. Where the default OpenSSL config file actually lives depends on how OpenSSL is being linked to Node.js.

Sharing the OpenSSL configuration may have unwanted implications 😭 and it's recommended to use a configuration section specific to Node.js, which is nodejs_conf and is the default when this option is not used.

• --pending-deprecation — emits pending deprecation warnings. Pending deprecations are generally identical to a runtime deprecation, with one notable exception: they're turned off by default and won't be emitted unless either the --pending-deprecation command-line flag or the NODE_PENDING_DEPRECATION=1 environment variable is set. Think of pending deprecations as a selective "early warning" mechanism that developers can use to detect deprecated API usage 👀
• --permission — enables the Permission Model for the current process. Once it's on, the following permissions are restricted:
  • File System — manageable through --allow-fs-read, --allow-fs-write flags
  • Network — manageable through --allow-net flag
  • Child Process — manageable through --allow-child-process flag
  • Worker Threads — manageable through --allow-worker flag
  • WASI — manageable through --allow-wasi flag
  • Addons — manageable through --allow-addons flag
  • FFI — manageable through --allow-ffi flag
  • OpenSSL STORE loaders — manageable through --allow-openssl-store flag
• --permission-audit — enables audit mode for the permission model. This is the ✨vibe check✨ version: permission checks get performed, but access is not denied — no ERR_ACCESS_DENIED error gets thrown. Instead, each permission violation is published through the node:diagnostics_channel module, and execution just carries on normally.

This flag does not require --permission to be specified. The --allow-* flags aren't needed in audit mode either, since nothing is being denied 💅

Audit mode is literally so useful for discovering what permissions your app requires before you deploy with --permission. See the Permission Model documentation for the list of diagnostics channel names and the message format.

If both --permission and --permission-audit are specified, --permission takes precedence and the Permission Model runs in enforce mode. Main character wins 👑

• --preserve-symlinks — tells the module loader to preserve symbolic links when resolving and caching modules. By default, when Node.js loads a module from a path that's symbolically linked to a different on-disk location, Node.js dereferences the link and uses the actual on-disk "real path" of the module as both an identifier and as a root path to locate other dependency modules. In most cases that default behavior is totally acceptable. But — when you're using symbolically linked peer dependencies, like in the example below, the default behavior causes an exception to be thrown if moduleA attempts to require moduleB as a peer dependency:

{appDir}
 ├── app
 │   ├── index.js
 │   └── node_modules
 │       ├── moduleA -> {appDir}/moduleA
 │       └── moduleB
 │           ├── index.js
 │           └── package.json
 └── moduleA
     ├── index.js
     └── package.json

The --preserve-symlinks command-line flag tells Node.js to use the symlink path for modules instead of the real path, which lets symbolically linked peer dependencies be found 🎀

Note, however, that using --preserve-symlinks can have other side effects. Specifically, symbolically linked native modules can fail to load if those are linked from more than one location in the dependency tree — Node.js would see those as two separate modules and would attempt to load the module multiple times, causing an exception to be thrown 💀

Also: the --preserve-symlinks flag does not apply to the main module, which is what lets node --preserve-symlinks node_module/.bin/<foo> work. To apply the same behavior for the main module, also use --preserve-symlinks-main.

• --preserve-symlinks-main — tells the module loader to preserve symbolic links when resolving and caching the main module (require.main). This flag exists so the main module can opt in to the same behavior that --preserve-symlinks gives to all other imports. They're separate flags, however, for backward compatibility with older Node.js versions. And --preserve-symlinks-main does not imply --preserve-symlinks — use --preserve-symlinks-main in addition to --preserve-symlinks when it's not desirable to follow symlinks before resolving relative paths. See --preserve-symlinks for more information 🫶
• -p, --print script — identical to -e but prints the result. That's the whole thing. Iconic, honestly 💅
• --process-timeout=*duration — exits the process with code 124 if it's still running after duration, measured from the start of the process. duration is a positive integer followed by a unit: ms, s, m, or h — for example 500ms, 30s, 5m, or 1h. The exit code matches the one used by the timeout(1) command ⏰

Before exiting, Node.js prints what the main thread was doing and which resources were keeping the event loop alive, all to stderr:

…and here's what that hot mess looks like when it actually fires off, bestie:

$ node --process-timeout=5s server.js
(node:25418) Process timed out after 5s (--process-timeout). Exiting with code 124.
Main thread was not executing JavaScript.
Resources keeping the event loop alive:
    TCPServerWrap (listening on [::]:3000, fd 20)
    Timeout x2 (next due in 2931ms)

So if the main thread was executing JavaScript, you get its stack trace printed instead of that resources list, okay? And if you want even more tea, use --report-on-process-timeout to also generate a diagnostic report. 💅

The process exits without emitting the 'beforeExit' and 'exit' events, because like… the JavaScript code may literally be what keeps the process running, so. Code coverage and profiles, such as those enabled with NODE_V8_COVERAGE=dir or --cpu-prof, are still written though — she's not gonna ghost your data.

⚠️ If the main thread does not respond within two seconds — for example because it's blocked in a synchronous operation such as child_process.execSync() — Node.js exits immediately without printing the stack trace and resources. Rude but fair.

Okay, the ground rules, because this flag is so particular:

• This option is not allowed in NODE_OPTIONS.
• It cannot be combined with the options that enable the inspector, such as --inspect, --inspect-brk, --inspect-wait, --inspect-port, and --inspect-publish-uid.
• Nor with node inspect, --run, or --build-snapshot.
• While it is in effect, inspector.open() and session.connectToMainThread() throw, and requests to activate the inspector with SIGUSR1 are ignored. Blocked. Denied. Not today.

And the deets for the weird setups:

• Child processes that inherit process.execArgv, such as those created with child_process.fork(), apply the timeout from their own start.
• With --watch, the timeout applies to each run of the application rather than to the process that watches for changes.
• When running tests from the command line, the test runner process applies the timeout to the whole run, and each test file that runs in its own process applies it as well.

---

• --prof — Generate V8 profiler output. Go off, profiler. 🔥
• --prof-process — Process V8 profiler output generated using the V8 option --prof. Like, take that raw data and make it make sense.
• --redirect-warnings=file — Write process warnings to the given file instead of printing to stderr. The file gets created if it does not exist, and will be appended to if it does. If something goes wrong while attempting to write the warning to the file, the warning goes to stderr instead. The file name may be an absolute path — and if it's not, the default directory it gets written to is controlled by the --diagnostic-dir command-line option. 🎀
• --report-compact — Write reports in a compact format: single-line JSON, which is way more easily consumable by log processing systems than the default multi-line format designed for human consumption. (The default is for the girlies, this one is for the robots. 🤖)
• --report-dir=directory, --report-directory=directory — Location at which the report will be generated. Pick your venue, bestie. 📍
• --report-exclude-env — When --report-exclude-env is passed, the diagnostic report generated will not contain the environmentVariables data. Privacy era. 🙈
• --report-exclude-network — Exclude header.networkInterfaces from the diagnostic report. By default this is not set and the network interfaces are included. Opt out if you're feeling mysterious. 🦋
• --report-filename=filename — Name of the file to which the report will be written. If filename is set to 'stdout' or 'stderr', the report is written to the stdout or stderr of the process respectively. Choose your channel. 📡
• --report-on-fatalerror — Enables the report to be triggered on fatal errors (internal errors within the Node.js runtime such as out of memory) that lead to termination of the application. Lowkey useful to inspect various diagnostic data elements such as heap, stack, event loop state, resource consumption etc. to reason about the fatal error. Autopsy but make it aesthetic. 💀
• --report-on-process-timeout — Enables the report to be generated when --process-timeout expires, in addition to the summary printed to stderr. Useful to inspect the JavaScript and native stacks, the event loop state, and resource consumption to reason about why the process did not exit. Requires --process-timeout. Worker threads that do not provide their part of the report within two seconds — for example because they're blocked in a synchronous operation such as child_process.execSync() — are left out of it. Girl left on read. 👑

⚠️ Yeah — it genuinely requires --process-timeout. Don't try her solo.

• --report-on-signal — Enables report to be generated upon receiving the specified (or predefined) signal to the running Node.js process. The signal to trigger the report is specified through --report-signal. ✨
• --report-signal=signal — Sets or resets the signal for report generation (not supported on Windows). Default signal is SIGUSR2. 🎯
• --report-uncaught-exception — Enables report to be generated when the process exits due to an uncaught exception. Useful when inspecting the JavaScript stack in conjunction with native stack and other runtime environment data. For when it all goes up in flames and you need the receipts. 🔥
• -r, --require module — Preload the specified module at startup. Follows require()'s module resolution rules. module may be either a path to a file, or a node module name. Modules preloaded with --require will run before modules preloaded with --import. Modules are preloaded into the main thread as well as any worker threads, forked processes, or clustered processes. Everybody gets a copy, fr fr. 🫶
• --run — This runs a specified command from a package.json's "scripts" object. If a missing "command" is provided, it will list the available scripts. Passing --run without a command lists the available scripts and exits with a non-zero exit code:

$ node --run
Available scripts are:
  test: node --test

--run will traverse up to the root directory and finds a package.json file to run the command from. --run prepends ./node_modules/.bin for each ancestor of the current directory, to the PATH in order to execute the binaries from different folders where multiple node_modules directories are present, if ancestor-folder/node_modules/.bin is a directory. --run executes the command in the directory containing the related package.json. For example, the following command will run the test script of the package.json in the current folder:

$ node --run test

You can also pass arguments to the command. Any argument after -- will be appended to the script:

$ node --run test -- --verbose

Glow up your whole workflow, no cap. 💅

• --secure-heap-min=n — When using --secure-heap, the --secure-heap-min flag specifies the minimum allocation from the secure heap. The minimum value is 2. The maximum value is the lesser of --secure-heap or 2147483647. The value given must be a power of two. 🧚
• --secure-heap=n — Initializes an OpenSSL secure heap of n bytes. When initialized, the secure heap is used for selected types of allocations within OpenSSL during key generation and other operations. This is useful, for instance, to prevent sensitive information from leaking due to pointer overruns or underruns.

The secure heap is a fixed size and cannot be resized at runtime, so if used, it is important to select a large enough heap to cover all application uses. The heap size given must be a power of two. Any value less than 2 will disable the secure heap. The secure heap is disabled by default. The secure heap is not available on Windows. See CRYPTO_secure_malloc_init for more details. 🔐

• --snapshot-blob=path — When used with --build-snapshot, --snapshot-blob specifies the path where the generated snapshot blob is written to. If not specified, the generated blob is written to snapshot.blob in the current working directory.

When used without --build-snapshot, --snapshot-blob specifies the path to the blob that is used to restore the application state.

When loading a snapshot, Node.js checks that:

• The version, architecture, and platform of the running Node.js binary are exactly the same as that of the binary that generates the snapshot.
• The V8 flags and CPU features are compatible with that of the binary that generates the snapshot.

If they don't match, Node.js refuses to load the snapshot and exits with status code 1. It's giving "we are NOT the same." 💀

• --test — Starts the Node.js command line test runner. This flag cannot be combined with --watch-path, --check, --eval, --interactive, or the inspector. See the documentation on running tests from the command line for more details. 🧪
• --test-concurrency — The maximum number of test files that the test runner CLI will execute concurrently. If --test-isolation is set to 'none', this flag is ignored and concurrency is one. Otherwise, concurrency defaults to os.availableParallelism() - 1. Squad goals but make it threads. 🌈
• --test-coverage-branches=threshold — Require a minimum percent of covered branches. If code coverage does not reach the threshold specified, the process will exit with code 1. 👑
• --test-coverage-exclude — Excludes specific files from code coverage using a glob pattern, which can match both absolute and relative file paths. This option may be specified multiple times to exclude multiple glob patterns. If both --test-coverage-exclude and --test-coverage-include are provided, files must meet both criteria to be included in the coverage report. By default all the matching test files are excluded from the coverage report. Specifying this option will override the default behavior. 🎀
• --test-coverage-functions=threshold — Require a minimum percent of covered functions. If code coverage does not reach the threshold specified, the process will exit with code 1. 📊
• --test-coverage-include — Includes specific files in code coverage using a glob pattern, which can match both absolute and relative file paths. This option may be specified multiple times to include multiple glob patterns. If both --test-coverage-exclude and --test-coverage-include are provided, files must meet both criteria to be included in the coverage report. 💖
• --test-coverage-include-all — bestie this one is for the overachievers 💅 it pulls in source files that never even got loaded by the test run and drops them in the coverage report anyway, where they show up with zero coverage (brutal, honestly). Candidate files get searched for in the current working directory, and they're subject to the exact same --test-coverage-include and --test-coverage-exclude filtering as the rest of the report. no cap.
• --test-coverage-lines=threshold — sets a minimum percent of covered lines you're willing to accept. If your code coverage doesn't hit the threshold you specified, the process exits with code 1. it's giving "we have standards" ✨
• --test-force-exit — tells the test runner to just exit the process once all known tests have finished running, even if the event loop would otherwise stay alive being clingy. bye 👋
• --test-global-setup=module — point at a module that gets evaluated before all tests are executed, and it can be used to set up global state or fixtures for your tests 🎀 see the documentation on global setup and teardown for more deets.
• --test-isolation=mode — configures what kind of test isolation the runner uses. When mode is 'process', each test file runs in its own separate child process. When mode is 'none', all test files run in the same process as the test runner. The default isolation mode is 'process'. This flag is ignored if the --test flag is not present (rude but true). See the test runner execution model section for more info 🔍
• --test-name-pattern — a regular expression that configures the test runner to only execute tests whose name matches the pattern you gave it. See the documentation on filtering tests by name for more details. If you supply both --test-name-pattern and --test-skip-pattern, tests have to satisfy both requirements in order to be executed — double gatekeeping, iconic 🌸
• --test-only — configures the test runner to only execute top level tests that have the only option set. This flag is not necessary when test isolation is disabled. iykyk.
• --test-random-seed — sets the seed used to randomize test execution order. This applies to both test file execution order and queued tests within each file. Providing this flag enables randomization implicitly, even without --test-randomize. The value must be an integer between 0 and 4294967295. This flag cannot be used with --watch or --test-rerun-failures 🔥
• --test-randomize — randomizes test execution order. Applies to both test file execution order and queued tests within each file. This can help detect tests that rely on shared state or execution order (chaos as a diagnostic tool, we love to see it 🦋). The seed used for randomization is printed in the test summary and can be reused with --test-random-seed. For detailed behavior and examples, see randomizing tests execution order. This flag cannot be used with --watch or --test-rerun-failures.
• --test-reporter — a test reporter to use when running tests. See the documentation on test reporters for more details 🎀
• --test-reporter-destination — the destination for the corresponding test reporter. See the documentation on test reporters for more details.
• --test-rerun-failures — a path to a file that lets the test runner persist the state of the test suite between runs. The runner uses this file to figure out which tests already succeeded or failed, so it can re-run the failed ones without having to re-run the entire test suite (the way that this saves you time… obsessed 😭). The test runner will create this file if it does not exist. See the documentation on test reruns for more details.
• --test-shard — test suite shard to execute, in the format of <index>/<total>, where:
  • index is a positive integer, the index of the divided parts.
  • total is a positive integer, the total of divided parts.

This command divides all test files into total equal parts, and runs only the ones that happen to be in the index part. For example, to split your test suite into three parts, use this:

node --test --test-shard=1/3
node --test --test-shard=2/3
node --test --test-shard=3/3

• --test-skip-pattern — a regular expression that configures the test runner to skip tests whose name matches the pattern you provided. See the documentation on filtering tests by name for more details. If both --test-name-pattern and --test-skip-pattern are supplied, tests must satisfy both requirements in order to be executed 💜
• --test-timeout — a number of milliseconds after which the test execution will fail. If unspecified, subtests inherit this value from their parent. The default value is Infinity (yes, infinite patience, bestie 🌈).
• --test-update-snapshots — regenerates the snapshot files used by the test runner for snapshot testing. out with the old, in with the new ✨
• --throw-deprecation — throw errors for deprecations. not a vibe warning, an actual throw 💀
• --title=title — set process.title on startup.
• --tls-cipher-list=list — specify an alternative default TLS cipher list. Requires Node.js to be built with crypto support (which is the default).
• --tls-keylog=file — log TLS key material to a file. The key material is in NSS SSLKEYLOGFILE format and can be used by software (such as Wireshark) to decrypt the TLS traffic 👀

bestie that's literally the keys to the kingdom — treat that file like it's your diary, okay? 🔐

• --tls-max-v1.2 — set tls.DEFAULT_MAX_VERSION to 'TLSv1.2'. Use it to disable support for TLSv1.3.
• --tls-max-v1.3 — set default tls.DEFAULT_MAX_VERSION to 'TLSv1.3'. Use it to enable support for TLSv1.3.
• --tls-min-v1.0 — set default tls.DEFAULT_MIN_VERSION to 'TLSv1'. Use for compatibility with old TLS clients or servers.
• --tls-min-v1.1 — set default tls.DEFAULT_MIN_VERSION to 'TLSv1.1'. Use for compatibility with old TLS clients or servers.
• --tls-min-v1.2 — set default tls.DEFAULT_MIN_VERSION to 'TLSv1.2'. This is the default for 12.x and later, but the option is supported for compatibility with older Node.js versions.
• --tls-min-v1.3 — set default tls.DEFAULT_MIN_VERSION to 'TLSv1.3'. Use to disable support for TLSv1.2, which is not as secure as TLSv1.3 🔒
• --trace-deprecation — print stack traces for deprecations.
• --trace-env — prints info about any access to environment variables done in the current Node.js instance to stderr, including:
  • The environment variable reads that Node.js does internally.
  • Writes in the form of process.env.KEY = "SOME VALUE".
  • Reads in the form of process.env.KEY.
  • Definitions in the form of Object.defineProperty(process.env, 'KEY', {...}).
  • Queries in the form of Object.hasOwn(process.env, 'KEY'), process.env.hasOwnProperty('KEY') or 'KEY' in process.env.
  • Deletions in the form of delete process.env.KEY.
  • Enumerations in the form of ...process.env or Object.keys(process.env).

Only the names of the environment variables being accessed are printed. The values are not printed. To print the stack trace of the access, use --trace-env-js-stack and/or --trace-env-native-stack 🕵️‍♀️

• --trace-env-js-stack — in addition to what --trace-env does, this prints the JavaScript stack trace of the access.
• --trace-env-native-stack — in addition to what --trace-env does, this prints the native stack trace of the access.
• --trace-event-categories — a comma separated list of categories that should be traced when trace event tracing is enabled using --trace-events-enabled.
• --trace-event-file-pattern — template string specifying the filepath for the trace event data. It supports ${rotation} and ${pid} 🎀
• --trace-events-enabled — enables the collection of trace event tracing information.
• --trace-exit — prints a stack trace whenever an environment is exited proactively, i.e. invoking process.exit(). snitching on your own code, love that for you 💅
• --trace-require-module=mode — prints info about usage of Loading ECMAScript modules using require(). When mode is 'all', all usage is printed. When mode is 'no-node-modules', usage from the node_modules folder is excluded.
• --trace-sigint — prints a stack trace on SIGINT.
• --trace-sync-io — prints a stack trace whenever synchronous I/O is detected after the first turn of the event loop.
• --trace-tls — prints TLS packet trace information to stderr. This can be used to debug TLS connection problems 🐛
• --trace-uncaught — print stack traces for uncaught exceptions. Usually the stack trace associated with the creation of an Error is printed, whereas this makes Node.js also print the stack trace associated with throwing the value (which does not need to be an Error instance).

heads up bestie: enabling this option may affect garbage collection behavior negatively 💀

• --trace-warnings — print stack traces for process warnings (including deprecations).
• --track-heap-objects — track heap object allocations for heap snapshots.
• --unhandled-rejections=mode — this flag lets you change what should happen when an unhandled rejection occurs. Pick one of these modes:
  • throw: emit unhandledRejection. If this hook is not set, raise the unhandled rejection as an uncaught exception. This is the default.
  • strict: raise the unhandled rejection as an uncaught exception. If the exception is handled, unhandledRejection is emitted.
  • warn: always trigger a warning, no matter if the unhandledRejection hook is set or not, but do not print the deprecation warning.
  • warn-with-error-code: emit unhandledRejection. If this hook is not set, trigger a warning, and set the process exit code to 1.
  • none: silence all warnings 🤫

If a rejection happens during the command line entry point's ES module static loading phase, it will always be raised as an uncaught exception. periodt.

• --use-bundled-ca, --use-openssl-ca — okay so this is your classic pick-a-CA-store moment 💅 You either use the bundled Mozilla CA store as supplied by your current Node.js version, or you use OpenSSL's default CA store. Which one is the default default? That's selectable at build-time, bestie. The bundled CA store, as supplied by Node.js, is a snapshot of the Mozilla CA store fixed at release time, and it is identical on all supported platforms. Rolling with the OpenSSL store lets the store be modified from the outside — for most Linux and BSD distributions, that store is maintained by the distribution maintainers and system administrators. Where the OpenSSL CA store lives depends on how the OpenSSL library is configured, but you can change it at runtime using environment variables. See SSL_CERT_DIR and SSL_CERT_FILE. ✨
• --use-env-proxy — flip this on and Node.js parses the HTTP_PROXY, HTTPS_PROXY and NO_PROXY environment variables during startup, and routes requests through the proxy you specified. Use this only with proxies that are trusted and authorized for the deployment, no cap. Proxy support is meant for reaching external networks through authorized proxy servers — like when a firewall requires one. It is not for hiding traffic or evading network policy, and that's on periodt. See Built-in Proxy Support. This is equivalent to setting the NODE_USE_ENV_PROXY=1 environment variable, and when both are set, --use-env-proxy takes precedence. 👑
• --use-largepages=mode — plot twist bestie: this option is no longer supported and is a total no-op 🙈 It used to re-map the Node.js static code to large memory pages at startup. It still accepts the following values for compatibility though:
  • off: no mapping will be attempted. This is the default.
  • on: no mapping will be attempted and a message will be printed to standard error stating it's no longer supported.
  • silent: same as off.
• --use-system-ca — Node.js uses the trusted CA certificates present in the system store along with the --use-bundled-ca option and the NODE_EXTRA_CA_CERTS environment variable. 🦋

On platforms other than Windows and macOS, this loads certificates from the directory and file trusted by OpenSSL, similar to --use-openssl-ca, with the difference being that it caches the certificates after first load.

On Windows and macOS, the certificate trust policy is similar to Chromium's policy for locally trusted certificates, but with some differences. On macOS, the following settings are respected:

• Default and System Keychains.Bl -bullet
• Trust:.Bl -bullet
• Any certificate where the “When using this certificate” flag is set to “Always Trust” or
• Any certificate where the “Secure Sockets Layer (SSL)” flag is set to “Always Trust”.

The certificate must also be valid, with "X.509 Basic Policy" set to “Always Trust”.

On Windows, the following settings are respected:

• Local Machine (accessed via certlm.msc).Bl -bullet
• Trust:.Bl -bullet
  • Trusted Root Certification Authorities
  • Trusted People
  • Enterprise Trust -> Enterprise -> Trusted Root Certification Authorities
  • Enterprise Trust -> Enterprise -> Trusted People
  • Enterprise Trust -> Group Policy -> Trusted Root Certification Authorities
  • Enterprise Trust -> Group Policy -> Trusted People
• Current User (accessed via certmgr.msc).Bl -bullet
• Trust:.Bl -bullet
  • Trusted Root Certification Authorities
  • Enterprise Trust -> Group Policy -> Trusted Root Certification Authorities

On Windows and macOS, Node.js would check that the user settings for the trusted certificates do not forbid them for TLS server authentication before using them. Node.js currently does not support distrust/revocation of certificates from another source based on system settings.

On other systems, Node.js loads certificates from the default certificate file (typically /etc/ssl/cert.pem) and default certificate directory (typically /etc/ssl/certs) that the version of OpenSSL that Node.js links to respects. This typically works with the convention on major Linux distributions and other Unix-like systems. If the overriding OpenSSL environment variables (typically SSL_CERT_FILE and SSL_CERT_DIR, depending on the configuration of the OpenSSL that Node.js links to) are set, the specified paths will be used to load certificates instead. These environment variables can be used as workarounds if the conventional paths used by the version of OpenSSL Node.js links to are not consistent with the system configuration that the users have for some reason.

---

Okay next up, a few quick ones that are literally just one-liners 🌸

• Print V8 command-line options.
• Set V8's thread pool size which will be used to allocate background jobs. If set to 0 then Node.js will choose an appropriate size of the thread pool based on an estimate of the amount of parallelism. The amount of parallelism refers to the number of computations that can be carried out simultaneously in a given machine. In general, it's the same as the amount of CPUs, but it may diverge in environments such as VMs or containers.
• Print node's version. 💖

---

• --vfs-load=source <string> — source is a directory or an archive file to mount and run. Requires --experimental-vfs. May be given at most once. 🧚

Mounts source as a virtual file system (node:vfs), and runs the entry point and all subsequent require()/import resolution against that mount rather than the real file system. The mount is placed at a reserved mount point assigned by Node.js, so it never shadows real paths and no target can be chosen.

The entry point is taken from the mount the same way node <directory> takes one: the mount's own package.json "main", or index.js. Any positional command-line argument is the program's own (available from process.argv[2] onward), never an entry-point override. process.argv[1] reports source rather than the reserved mount point, since the mount point is an opaque implementation detail.

The provider backing a source is chosen from the source itself rather than from its file name:

• A directory is mounted with a RealFSProvider rooted there.
• A file whose bytes are a ZIP archive is mounted with a ZipProvider, so an archive can carry any name.

Providers registered with vfs.registerProvider() (typically from a module preloaded with --require or --import) are consulted first, in reverse registration order, and may claim directories as well as files. If no provider claims the source, Node.js exits with an error.

In worker threads --vfs-load mounts but does not load: a worker inherits the mount and runs its own entry point, which may itself live in the mount. The source is mounted at the same reserved mount point in every thread that mounts it, whatever else that thread mounts, so a path into the mount means the same thing in all of them.

A worker created with its own execArgv inherits none of the parent's options, and so does not mount the source at all. To run a script from the mount, such a worker must be given the same options again, --experimental-vfs and --vfs-load; without them, that thread has no mount for the script to come from, and the worker fails to load it. --experimental-vfs is also what makes node:vfs available to the worker's own code. A worker whose script comes from anywhere else, such as the real file system, needs nothing added. 🫶

--vfs-load is not permitted in NODE_OPTIONS: which entry point runs is the command line's decision, and the environment must not be able to redirect it. 💀

$ node --experimental-vfs --vfs-load=app.zip

• --watch — starts Node.js in watch mode. 👀 When in watch mode, changes in the watched files cause the Node.js process to restart. By default, watch mode will watch the entry point and any required or imported module. Use --watch-path to specify what paths to watch. This flag cannot be combined with --check, --eval, --interactive, or the REPL.

Note: The --watch flag requires a file path as an argument and is incompatible with --run or inline script input, as --run takes precedence and ignores watch mode. If no file is provided, Node.js will exit with status code 9. 😭

node --watch index.js

• --watch-kill-signal — customizes the signal sent to the process on watch mode restarts.

node --watch --watch-kill-signal SIGINT test.js

• --watch-path — starts Node.js in watch mode and specifies what paths to watch. When in watch mode, changes in the watched paths cause the Node.js process to restart. This will turn off watching of required or imported modules, even when used in combination with --watch. This flag cannot be combined with --check, --eval, --interactive, --test, or the REPL.

Note: Using --watch-path implicitly enables --watch, which requires a file path and is incompatible with --run, as --run takes precedence and ignores watch mode.

node --watch-path=./src --watch-path=./tests index.js

This option is only supported on macOS and Windows. An ERR_FEATURE_UNAVAILABLE_ON_PLATFORM exception will be thrown when the option is used on a platform that does not support it.

• --watch-preserve-output — disables the clearing of the console when watch mode restarts the process.

node --watch --watch-preserve-output test.js

• Automatically zero-fills all newly allocated Buffer instances. 🎀

---

🌈 ENVIRONMENT 🌈

• FORCE_COLOR [1, 2, 3] — the FORCE_COLOR environment variable is used to enable ANSI colorized output. The value may be:
  • 1, true, or the empty string '' indicate 16-color support,
  • 2 to indicate 256-color support, or
  • 3 to indicate 16 million-color support.

When FORCE_COLOR is used and set to a supported value, both the NO_COLOR, and NODE_DISABLE_COLORS environment variables are ignored. Any other value will result in colorized output being disabled. 💅

• NODE_COMPILE_CACHE dir — enable the module compile cache for the Node.js instance. See the documentation of module compile cache for details. ⭐
• NODE_COMPILE_CACHE_PORTABLE 1 — when set to 1, the module compile cache can be reused across different directory locations as long as the module layout relative to the cache directory remains the same, and by any user (the cache subdirectory is not suffixed with the creating user's uid).
• NODE_COMPILE_CACHE_READONLY 1 — when set to 1, the module compile cache only reads existing entries from its directory: nothing is written to it and it is not created if missing. 🍓
• NODE_DEBUG module[,…] — ','-separated list of core modules that should print debug information.
• NODE_DEBUG_NATIVE module[,…] — ','-separated list of core C++ modules that should print debug information.
• NODE_DISABLE_COLORS 1 — when set, colors will not be used in the REPL.
• NODE_DISABLE_COMPILE_CACHE 1 — disable the module compile cache for the Node.js instance. See the documentation of module compile cache for details. 🔥

💖 NODE_EXTRA_CA_CERTS file

Okay bestie, this one is about adding extra trusted certs. When set, the well known "root" CAs (like VeriSign) will be extended with the extra certificates in file. That file should consist of one or more trusted certificates in PEM format. A message will be emitted (once) with process.emitWarning() if the file is missing or malformed, but any errors are otherwise ignored. Also, neither the well known nor extra certificates are used when the ca options property is explicitly specified for a TLS or HTTPS client or server. This environment variable is ignored when node runs as setuid root or has Linux file capabilities set. And FYI: the NODE_EXTRA_CA_CERTS environment variable is only read when the Node.js process is first launched. Changing the value at runtime using process.env.NODE_EXTRA_CA_CERTS has no effect on the current process. Periodt. 💅

🧚 NODE_ICU_DATA file

Data path for ICU (Intl object) data. Will extend linked-in data when compiled with small-icu support. ✨

🙈 NODE_NO_WARNINGS 1

When set to 1, process warnings are silenced. That’s it. No cap. 🤫

🌈 NODE_OPTIONS options...

Okay so this is the big one: a space-separated list of command-line options. The options... are interpreted before command-line options, so command-line options will override or compound after anything in options.... Node.js will exit with an error if an option that is not allowed in the environment is used, such as -p or a script file. If an option value contains a space, it can be escaped using double quotes:

NODE_OPTIONS='--require "./my path/file.js"'

A singleton flag passed as a command-line option will override the same flag passed into NODE_OPTIONS:

# The inspector will be available on port 5555
NODE_OPTIONS='--inspect=localhost:4444' node --inspect=localhost:5555

A flag that can be passed multiple times will be treated as if its NODE_OPTIONS instances were passed first, and then its command-line instances afterwards:

NODE_OPTIONS='--require "./a.js"' node --require "./b.js"
# is equivalent to:
node --require "./a.js" --require "./b.js"

Node.js options that are allowed are in the following list. If an option supports both --XX and --no-XX variants, they are both supported but only one is included in the list below. 👇

• --allow-addons
• --allow-child-process
• --allow-ffi
• --allow-fs-read
• --allow-fs-vfs
• --allow-fs-write
• --allow-inspector
• --allow-net
• --allow-openssl-store
• --allow-wasi
• --allow-worker
• --bench-isolation
• --bench-name-pattern
• --bench-reporter-destination
• --bench-reporter
• --bench-samples
• --bench-warmup
• --conditions, -C
• --cpu-prof-dir
• --cpu-prof-interval
• --cpu-prof-name
• --cpu-prof
• --diagnostic-dir
• --disable-proto
• --disable-sigusr1
• --disable-warning
• --disable-wasm-trap-handler
• --dns-result-order
• --enable-fips-indicator-events
• --enable-fips
• --enable-network-family-autoselection
• --enable-source-maps
• --entry-url
• --experimental-abortcontroller
• --experimental-addon-modules
• --experimental-bench
• --experimental-detect-module
• --experimental-dtls
• --experimental-eventsource
• --experimental-import-meta-resolve
• --experimental-import-text
• --experimental-json-modules
• --experimental-loader
• --experimental-modules
• --experimental-package-map
• --experimental-print-required-tla
• --experimental-quic
• --experimental-require-module
• --experimental-shadow-realm
• --experimental-specifier-resolution
• --experimental-stream-iter
• --experimental-test-isolation
• --experimental-top-level-await
• --experimental-vfs
• --experimental-vm-modules
• --experimental-wasi-unstable-preview1
• --experimental-web-worker
• --force-context-aware
• --force-fips
• --force-node-api-uncaught-exceptions-policy
• --frozen-intrinsics
• --heap-prof-dir
• --heap-prof-interval
• --heap-prof-name
• --heap-prof
• --heapsnapshot-near-heap-limit
• --heapsnapshot-signal
• --http-parser
• --icu-data-dir
• --import
• --input-type
• --insecure-http-parser
• --inspect-brk
• --inspect-port, --debug-port
• --inspect-publish-uid
• --inspect-wait
• --inspect
• --localstorage-file
• --max-http-header-size
• --max-old-space-size-percentage
• --network-family-autoselection-attempt-timeout
• --no-addons
• --no-async-context-frame
• --no-deprecation
• --no-experimental-ffi
• --no-experimental-global-navigator
• --no-experimental-repl-await
• --no-experimental-sqlite
• --no-experimental-strip-types
• --no-experimental-websocket
• --no-experimental-webstorage
• --no-extra-info-on-fatal-exception
• --no-force-async-hooks-checks
• --no-global-search-paths
• --no-network-family-autoselection
• --no-strip-types
• --no-warnings
• --no-webstorage
• --no-worker-snapshot
• --node-memory-debug
• --openssl-config
• --openssl-legacy-provider
• --openssl-shared-config
• --pending-deprecation
• --permission-audit
• --permission
• --preserve-symlinks-main
• --preserve-symlinks
• --prof-process
• --redirect-warnings
• --report-compact
• --report-dir, --report-directory
• --report-exclude-env
• --report-exclude-network
• --report-filename
• --report-on-fatalerror
• --report-on-signal
• --report-signal
• --report-uncaught-exception
• --require-module
• --require, -r
• --secure-heap-min
• --secure-heap
• --snapshot-blob
• --test-coverage-branches
• --test-coverage-exclude
• --test-coverage-functions
• --test-coverage-include-all
• --test-coverage-include
• --test-coverage-lines
• --test-global-setup
• --test-isolation
• --test-name-pattern
• --test-only
• --test-random-seed
• --test-randomize
• --test-reporter-destination
• --test-reporter
• --test-rerun-failures
• --test-shard
• --test-skip-pattern
• --throw-deprecation
• --title
• --tls-cipher-list
• --tls-keylog
• --tls-max-v1.2
• --tls-max-v1.3
• --tls-min-v1.0
• --tls-min-v1.1
• --tls-min-v1.2
• --tls-min-v1.3
• --trace-deprecation
• --trace-env-js-stack
• --trace-env-native-stack
• --trace-env
• --trace-event-categories
• --trace-event-file-pattern
• --trace-events-enabled
• --trace-exit
• --trace-require-module
• --trace-sigint
• --trace-sync-io
• --trace-tls
• --trace-uncaught
• --trace-warnings
• --track-heap-objects
• --unhandled-rejections
• --use-bundled-ca
• --use-env-proxy
• --use-largepages
• --use-openssl-ca
• --use-system-ca
• --v8-pool-size
• --watch-kill-signal
• --watch-path
• --watch-preserve-output
• --watch
• --zero-fill-buffers

V8 options that are allowed are:

• --abort-on-uncaught-exception
• --disallow-code-generation-from-strings
• --enable-etw-stack-walking
• --expose-gc
• --interpreted-frames-native-stack
• --jitless
• --max-heap-size
• --max-old-space-size
• --max-semi-space-size
• --perf-basic-prof-only-functions
• --perf-basic-prof
• --perf-prof-unwinding-info
• --perf-prof
• --stack-trace-limit

--perf-basic-prof-only-functions, --perf-basic-prof, --perf-prof-unwinding-info, and --perf-prof are only available on Linux. --enable-etw-stack-walking is only available on Windows. 🐧🪟

🦋 NODE_PATH path[:…]

A ':'-separated list of directories prefixed to the module search path. On Windows, this is a ';'-separated list instead. Slay that cross-platform vibe. 💻✨

NODE_PENDING_DEPRECATION = 1

Set it to 1 and Node starts dropping pending deprecation warnings 💅. Okay so pending deprecations are basically runtime deprecations' chill cousin — same energy, except they're off by default and will NOT show up unless you either pass the --pending-deprecation command-line flag or set NODE_PENDING_DEPRECATION=1. It's giving selective "early warning" system, and it's literally there so devs can catch deprecated API usage before it becomes a whole thing 🔥.

NODE_PENDING_PIPE_INSTANCES = instances

Sets how many pending pipe instance handles exist while the pipe server is waiting for connections. Windows only, bestie — don't come for me 🫶.

NODE_PRESERVE_SYMLINKS = 1

Set to 1 and you're telling the module loader "preserve symbolic links when resolving and caching modules" ✨. Symlinks stay symlinks, no cap.

NODE_REDIRECT_WARNINGS = file

Set this and process warnings go into the given file instead of getting printed to stderr 🎀. The file gets created if it doesn't exist, and gets appended to if it does. If something goes wrong while trying to write the warning to the file, the warning goes to stderr instead. This is equivalent to using the --redirect-warnings=file command-line flag.

NODE_REPL_EXTERNAL_MODULE = file

Path to a Node.js module that gets loaded in place of the built-in REPL 🦋. Overriding this value to an empty string ('') will use the built-in REPL. Iconic.

NODE_REPL_HISTORY = file

Path to the file where your persistent REPL history lives 🌸. Default path is ~/.node_repl_history, which this variable overrides. Setting the value to an empty string ('' or ' ') disables persistent REPL history entirely — no receipts, no history, main character mystery vibe.

NODE_SKIP_PLATFORM_CHECK = value

If value equals '1', the check for a supported platform gets skipped during Node.js startup 😭. Real talk: Node.js might not execute correctly, and any issues you hit on unsupported platforms will not be fixed. You're on your own fr fr.

⚠️ That last bit is not a vibe — it's literally "we will not fix this." Proceed accordingly 💀.

NODE_TEST_CONTEXT = value

If value equals 'child', test reporter options get overridden and test output gets sent to stdout in the TAP format ✨. If it's any other value, Node.js makes no guarantees about the reporter format used or its stability. So, like, do with that what you will 🙈.

NODE_TLS_REJECT_UNAUTHORIZED = value

If value equals '0', certificate validation is disabled for TLS connections 💀. This makes TLS — and HTTPS by extension — insecure. The use of this environment variable is strongly discouraged. I'm not being dramatic, the manpage is being dramatic, we're all being dramatic together. Do not.

NODE_USE_ENV_PROXY = 1

When enabled, Node.js parses the HTTP_PROXY, HTTPS_PROXY and NO_PROXY environment variables during startup, and routes requests through the specified proxy 🧚. Use this only with proxies that are trusted and authorized for the deployment, bestie. Proxy support is intended for reaching external networks through authorized proxy servers — for example when a firewall requires one. It is not for hiding traffic or evading network policy 👑.

See Built-in Proxy Support. This can also be enabled using the --use-env-proxy command-line flag, and when both are set, --use-env-proxy takes precedence 🌈.

NODE_USE_SYSTEM_CA = 1

Node.js uses the trusted CA certificates present in the system store along with the --use-bundled-ca option and the NODE_EXTRA_CA_CERTS environment variable 🎀. This can also be enabled using the --use-system-ca command-line flag, and when both are set, --use-system-ca takes precedence ⭐.

NODE_V8_COVERAGE = dir

When set, Node.js begins outputting V8 JavaScript code coverage and Source Map data to the directory you passed as an argument (coverage info is written as JSON to files with a coverage prefix) 📊. NODE_V8_COVERAGE automatically propagates to subprocesses, which makes instrumenting apps that call the child_process.spawn() family of functions so much easier. It can be set to an empty string to prevent propagation 🦋.

NO_COLOR = <any>

NO_COLOR is an alias for NODE_DISABLE_COLORS 💅. The value of the environment variable is arbitrary — literally anything, we don't care, the vibes decide.

OPENSSL_CONF = file

Loads an OpenSSL configuration file on startup 🔐. The file can be used as part of a FIPS mode configuration. If the variable is set to an empty value, Node.js starts without loading any OpenSSL configuration file — which is a way past a default configuration file that exists but cannot be read, for example when /etc/ssl is not accessible to the user Node.js runs as, which is otherwise fatal at startup 💀. No configuration is applied in that case, including any FIPS mode setup the file would have performed. And if the --openssl-config command-line option is used, the environment variable is ignored, and an empty value has no effect 🫶.

SSL_CERT_DIR = dir

If --use-openssl-ca is enabled, or if --use-system-ca is enabled on platforms other than macOS and Windows, this overrides and sets OpenSSL's directory containing trusted certificates 🌸. Be aware that unless the child environment is explicitly set, this environment variable will be inherited by any child processes, and if they use OpenSSL, it may cause them to trust the same CAs as node 😭.

SSL_CERT_FILE = file

If --use-openssl-ca is enabled, or if --use-system-ca is enabled on platforms other than macOS and Windows, this overrides and sets OpenSSL's file containing trusted certificates 🌸. Same heads-up as above, bestie: unless the child environment is explicitly set, this variable gets inherited by any child processes, and if they use OpenSSL, it may cause them to trust the same CAs as node 😭.

TZ

The TZ environment variable specifies the timezone configuration 🌍. Node.js doesn't support all the various ways TZ is handled in other environments, but it does support basic timezone IDs — such as 'Etc/UTC', 'Europe/Paris', or 'America/New_York'. It may support a few other abbreviations or aliases, but these are strongly discouraged and not guaranteed. Periodt.

$ TZ=Europe/Dublin node -pe "new Date().toString()"
Wed May 12 2021 20:30:48 GMT+0100 (Irish Standard Time)

UV_THREADPOOL_SIZE = size

Sets the number of threads used in libuv's threadpool to size threads 🧵. Asynchronous system APIs are used by Node.js whenever possible, but where they don't exist, libuv's threadpool is used to create asynchronous node APIs based on synchronous system APIs. The Node.js APIs that use the threadpool are:

• all fs APIs, other than the file watcher APIs and those that are explicitly synchronous
• asynchronous crypto APIs such as crypto.pbkdf2(), crypto.scrypt(), crypto.randomBytes(), crypto.randomFill(), crypto.generateKeyPair()
• dns.lookup()
• all zlib APIs, other than those that are explicitly synchronous

Because libuv's threadpool has a fixed size, it means that if for whatever reason any of these APIs takes a long time, other (seemingly unrelated) APIs that run in libuv's threadpool will experience degraded performance 😭. To mitigate this, one potential solution is to increase the size of libuv's threadpool by setting the 'UV_THREADPOOL_SIZE' environment variable to a value greater than 4 (its current default value).

⚠️ Fair warning though: setting this from inside the process using process.env.UV_THREADPOOL_SIZE=size is not guaranteed to work, because the threadpool would have been created as part of the runtime initialisation, way before user code is run. So like... set it in your actual environment, bestie 💅.

For more information, see the libuv threadpool documentation.

---

🐛 BUGS

Bugs are tracked in GitHub Issues: https://github.com/nodejs/node/issues — come through, report responsibly 🫶.

©️ COPYRIGHT

Copyright Node.js contributors. Node.js is available under the MIT license 🎀.

Node.js also includes external libraries that are available under a variety of licenses. See https://github.com/nodejs/node/blob/HEAD/LICENSE for the full license text.

👀 SEE ALSO

• Website: https://nodejs.org/
• Documentation: https://nodejs.org/api/
• GitHub repository and issue tracker: https://github.com/nodejs/node

---

And that's a wrap on NODE(1), bestie 🌈💖 — this page is dated $Mdocdate$ and it's the NODE(1) manual, so go forth, read your env vars, and please leave NODE_TLS_REJECT_UNAUTHORIZED alone. Slay responsibly 🎀✨