nestjs / nest
91%
master: 90%

LAST BUILD BRANCH: fix/tcp-hardening-v11
DEFAULT BRANCH: master
Repo Added
Files 368
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH fix/tcp-hardening-v11
branch: SELECT
CHANGE BRANCH
x

coverage: 90.665%. First build
5cae4f21-5aab-43bd-a448-55e9f7b1b729

Pull #17749

circleci

kamilmysliwiec 
fix(microservices): harden the tcp transport against a hostile peer

Backport of the shutdown and memory-bound fixes from 12.x.

"ServerTCP#close" only called "net.Server#close", which stops the server
from accepting new connections but leaves established ones untouched. A
connection opened before the shutdown therefore survived it: the process
was kept alive by the dangling socket long after "app.close()" resolved,
and messages arriving on that connection were still dispatched to message
handlers. Accepted sockets are now tracked and destroyed when the server
closes.

Two further paths let a single peer grow the process heap without limit.
A peer could declare a packet length, send part of the payload and then
go silent, and nothing ever reaped the connection. On the sending side
the return value of "socket.write" was discarded, so a peer that issued
requests without reading the responses made the process queue every
response in memory.

An idle timer now drops a peer that stops sending mid-packet. It is
refreshed on every read, so a slow but progressing transfer is never
interrupted and a peer sitting idle between packets is left alone.
Reading is suspended while a peer's outgoing buffer is backed up, and
responses queued for a peer that reads nothing are capped. Both limits
are configurable on the server and the client through the new
"incompleteMessageTimeout" and "maxSendBufferSize" options, and either
can be turned off by setting it to 0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Pull Request #17749: fix(microservices): harden the TCP transport against a hostile peer (v11 backport)

2462 of 2998 branches covered (82.12%)

73 of 75 new or added lines in 6 files covered. (97.33%)

7964 of 8784 relevant lines covered (90.66%)

66.04 hits per line

Relevant lines Covered
8784 RELEVANT LINES 7964 COVERED LINES
66.04 HITS PER LINE
Source Files on master

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
5cae4f21... fix/tcp-hardening-v11 fix(microservices): harden the tcp transport against a hostile peer Backport of the shutdown and memory-bound fixes from 12.x. "ServerTCP#close" only called "net.Server#close", which stops the server from accepting new connections but leaves est... Pull #17749 kamilmysliwiec circleci
90.66
ff75f79e... bugfix/serializer-global-options feat(common): allow injecting global serializer options Merge interceptor option declaration with class transform options. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Pull #16966 web-flow circleci
89.9
8ee150eb... master Merge pull request #17414 from nestjs/dependabot/npm_and_yarn/mysql2-3.23.2 Pull #17592 kamilmysliwiec circleci
90.34
c921ee81... fix/circular-durable-providers fix(core): circular durable providers issue #17562 Pull #17563 kamilmysliwiec circleci
90.44
f032bca6... fix/instrument-bugs-and-flaws chore: drop skip instrumentation - duplicated api Pull #17559 kamilmysliwiec circleci
90.45
7c7588ac... fix/instrument-bugs-and-flaws fix(core): preserve middleware arity #17554 Pull #17559 kamilmysliwiec circleci
90.46
2e168005... renovate/typescript-eslint-monorepo chore(deps): update typescript-eslint monorepo to v8.67.0 Pull #17475 web-flow circleci
90.44
5c7bf59f... renovate/globals-17.x chore(deps): update dependency globals to v17.11.0 Pull #17460 web-flow circleci
90.44
be7374ba... renovate/eslint-monorepo chore(deps): update eslint monorepo Pull #17474 web-flow circleci
90.44
55e23b58... master chore(release): publish v11.2.1 release push kamilmysliwiec circleci
90.44
See All Builds (30031)