I am going to answer your question with a barrage of other questions.
Well does your app actually need to hit the open internet ? or can it simply exist on a company intranet?
The majority of 'java exploits' are simply ways that java's sandbox can get broken out of and of little consequence to legitimate java applications since it is really a apples and oranges comparison.
The majority of 'browser exploits' are of a similar vein (gaining access to a system or other data in the browser, by breaking out of the browsers sandbox. ) Chrome helps a little bit in this though.
That being said the majority of 'web server' exploits are based around being able to execute your own code or extract data that you are not supposed to.
If you have a java app talking directly to a C back-end via sockets how locked down is your C app? The potential for damage can be quite high ( since depending on your software you have the potential for rop chain exploits or even direct code execution, as well as having your entire processes memory becoming available.)
This would require a more sophisticated attacker.
On the other hand if you have a COTS web-server then you run the risk of having a less skilled attacker be able to run around your systems.
And all re-writes are doomed to make the same mistakes that the original code made, (even if the original programmer is still around. )
I would personally stay away from node.js simply because it is such a immature technology compared to other options.
What is the potential cost of compromise?
What is the potential outcome for compromise?
Who would have a vested interest in compromise said system?
Is it data theft or data manipulation that will hurt the most?