You can avoid DDOS attacks in Node.js by:
- limiting the maximum number of open connections from a single IP
- imposing a minimum transfer speed
- imposing a maximum time a connection can stay open, which means setting a timeout for the connection.
And I want to add that performance must sometimes be sacrificed in order to avoid incorporating ineffective defenses.