fix: limit memory leak to AppSec being enabled#7276
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #7276 +/- ##
=======================================
Coverage 80.34% 80.35%
=======================================
Files 731 731
Lines 31093 31105 +12
=======================================
+ Hits 24981 24993 +12
Misses 6112 6112
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Contributor
Overall package sizeSelf size: 4.58 MB Dependency sizes| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 2.0.6 | 81.92 kB | 813.08 kB | | dc-polyfill | 0.1.10 | 26.73 kB | 26.73 kB |🤖 This report was automatically generated by heaviest-objects-in-the-universe |
This comment has been minimized.
This comment has been minimized.
This fixes a memory leak by making sure the exposed req and res of http are not hold onto strongly. It does that by skipping adding these to the store, if not needed as well as creating a WeakRef when it is needed. That way AppSec still has access to these as long as the request is alive. Router now also uses a WeakMap for the context to prevent any hard references and the parent store in http server is refactored next to using private properties and adding some types. Fixes: #6389
BridgeAR
force-pushed
the
BridgeAR/2026-01-19-fix-6389
branch
from
ac69075 to
8ae52ce
Compare
BenchmarksBenchmark execution time: 2026-02-09 00:53:19 Comparing candidate commit 8614498 in PR branch Found 0 performance improvements and 0 performance regressions! Performance is the same for 231 metrics, 29 unstable metrics. |
rochdev
reviewed
Jan 20, 2026
| class RouterPlugin extends WebPlugin { | ||
| static id = 'router' | ||
|
|
||
| #storeStacks = new WeakMap() |
Member
There was a problem hiding this comment.
These changes are a nice to have, but unrelated to this PR and in the future it would be best to make those unrelated changes in another PR to avoid unnecessary noise.
BridgeAR
changed the title
simon-id
approved these changes
Feb 10, 2026
Merged
juan-fernandez
pushed a commit
that referenced
this pull request
Feb 12, 2026
BridgeAR
added a commit
that referenced
this pull request
Feb 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This fixes a memory leak by making sure the exposed req and res ofhttp are not hold onto strongly.
It does that by skipping adding these to the store, if not needed
as well as creating a WeakRef when it is needed. That way AppSec
still has access to these as long as the request is alive.
This limits a AppSec specific memory leak to only surface in case AppSec
is enabled. That is just a stop gap to limit the impact on our users until we
have a proper fix that needs further rework.
Refs: #6389
Router now correlates the storeStacks to the correct middleware exit.
Before, these were expected to always be in order while multiple parallel
calls could potentially interfere with that and correlate wrong entries.