Skip to content

https: fix readable listener leak during proxy CONNECT - #62913

Open
thisalihassan wants to merge 2 commits into
nodejs:mainfrom
thisalihassan:fix-https-tunnel-readable-listener-leak
Open

thisalihassan wants to merge 2 commits into
nodejs:mainfrom
thisalihassan:fix-https-tunnel-readable-listener-leak

Conversation

@thisalihassan

Copy link
Copy Markdown
Contributor

establishTunnel() reused the same function as both the initial reader and the 'readable' listener, and re-subscribed it at the end of every call. Because EventEmitter iterates a snapshot of its listeners per emit, each 'readable' event fired every already-attached copy, and each copy re-subscribed

Fixes: #62904

@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/crypto
  • @nodejs/http
  • @nodejs/net

@nodejs-github-bot nodejs-github-bot added https Issues and PRs related to the https subsystem. needs-ci PRs that need a full CI run. labels Apr 23, 2026
@codecov

codecov Bot commented Apr 23, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.62%. Comparing base (f625c4b) to head (12f0f8d).
⚠️ Report is 918 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #62913      +/-   ##
==========================================
- Coverage   89.65%   89.62%   -0.03%     
==========================================
  Files         708      708              
  Lines      220410   220410              
  Branches    42270    42269       -1     
==========================================
- Hits       197605   197551      -54     
- Misses      14657    14704      +47     
- Partials     8148     8155       +7     
Files with missing lines Coverage Δ
lib/https.js 98.22% <100.00%> (ø)

... and 33 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

// Proxy server that writes the CONNECT response one byte at a time. Using the
// built-in HTTP server avoids having to parse the CONNECT request ourselves
// (which cannot rely on a single TCP chunk containing the whole request line).
const proxy = http.createServer();

@joyeecheung joyeecheung Apr 29, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you move the proxy to a separate process? I recall there can be problems otherwise if the environment contains proxy variables.

EDIT: looking at the patterns of other files I think it should be starting the request from a different process instead. Or at least avoid having the requester and the proxy in the same process.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@joyeecheung done, moved the requester to a subprocess via runProxiedRequest

establishTunnel() reused the same function as both the initial reader
and the 'readable' listener, and re-subscribed it at the end of every
call.

Fixes: nodejs#62904
Signed-off-by: Ali Hassan <ali-hassan27@outlook.com>
Signed-off-by: Ali Hassan <ali-hassan27@outlook.com>
@thisalihassan
thisalihassan force-pushed the fix-https-tunnel-readable-listener-leak branch from 44d675e to 12f0f8d Compare April 30, 2026 13:37
@github-actions

Copy link
Copy Markdown
Contributor

This pull request has been marked as stale due to 90 days of inactivity.
It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.

@github-actions github-actions Bot added the stale Issues and PRs marked stale due to inactivity and scheduled for automatic closure. label Jul 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

https Issues and PRs related to the https subsystem. needs-ci PRs that need a full CI run. stale Issues and PRs marked stale due to inactivity and scheduled for automatic closure.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

https proxy reattaches listeners without removing them

4 participants