Although I can't point to any specific reported defects, I'd be nervous about the node.js architecture - where your code runs as part of the webserver code. While with something like mod_php, there is still only a single process handling both the HTTP and logic tiers, there is a clear functional separation between the 2, and the interface between the webserver and the logic tier has been expressly designed and tested to accomodate failures - particulary in the logic tier.
Also, there are a lot of tools available for webservers (Apache in particular) which facilitate management and (used properly) enhance security.
Another major consideration is availability of skills/support/training - regardless of its quality / utility, node.js has a lot of catching up to do compared with other web development platforms.
Our development team has been considering using Node.js
That you are specifically trying to deliver what should be a very secure application on a platform which (judging from your statement above) you are not thoroughly familiar with seems to be very reckless. Most security vulnerabilities in web applications arise not because of faults in the development environment but in faults in the bespoke code added on top.
Certainly using a reverse proxy would facilitate getting standard HTTP logging, anomoly detection and reduce impact of protocol level attacks.
One of the best tools for building secure web applications is mod_security - AFAIK, this is only available to run within Apache - but it would offer the possibility (along with mod_proxy) of deploying a front-end system providing the usual webserver functionality (logging, static content) along with, say, authentication services, and using node.js as a backend.
