Urgent.News

What's breaking now, across thousands of outlets.

Tech

Why Node.js HTTP backpressure must count bytes, not string length

In Node.js, string.length counts UTF-16 code units, not bytes . When Node's HTTP OutgoingMessage buffered a write, it added data.length to the counters that drive backpressure, so multi-byte response bodies were under-counted by 2× for two-byte characters and 3× for most CJK text . write() kept returning true after the buffer was past its high-water mark, and the server paused the socket later…

In Node.js, string.length determines the number of UTF-16 code units, not bytes. The HTTP OutgoingMessage class buffers a write by adding data.length to the counters that drive backpressure. However, this leads to under-counting multi-byte response bodies by 2× for two-byte characters and 3× for most CJK text. write() would return true even if the buffer exceeded its high-water mark, delaying the server from pausing the socket.

The fix, proposed in nodejs/node#66039, counts bytes instead of code units. Backpressure in Node HTTP occurs when data is written to a response faster than the network can transmit it, causing data to queue in memory. Node signals to slow down by returning false from response.write() once the buffer reaches its highWaterMark. Internally, Node tracks a per-connection total to pause the TCP socket and HTTP parser when output queues become too large.

The bug's impact is minimal, demonstrated in four lines of code. The issue remained undetected due to an earlier change that added a `size` argument to `_writeRaw()` but was never utilized.

The fix uses the byte length passed by callers in `size` and falls back to `Buffer.byteLength(chunk, encoding)` only if the length is missing. It also accounts for the prepended header on the first write. The change adds the header's byte length to the body length count, ensuring accurate backpressure detection. The fix leaves other aspects of the code unchanged, preserving ASCII, Buffer, and latin1 behavior.

Performance tests revealed negligible overhead, confirming the fix's efficiency. The AI coding agent used for the project was disclosed and verified by reproducing the bug, proving the test catches the defect, and ensuring all expected values were accurate.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

How to build a secure MCP server with OAuth 2.1: lessons from a CRM connector

To let an AI assistant work with real business data over the Model Context Protocol (MCP) , the server needs two things done properly: authentication (OAuth 2.1 with PKCE, so the AI client never sees…

  • Implement OAuth 2.1 with PKCE for secure MCP server authentication
  • Treat access token as user session for row-level security
  • Implement read-only tools and clear error messages for AI models

Recharge Retries Run. The Question Is What Happens Between Them.

Stores running subscriptions on Recharge inherit a working retry engine, and that inheritance creates a particular blind spot: because attempts are visibly happening, the team assumes recovery is…

  • Subscribers often miss initial receipt correction for failed subscription
  • No information when subscription cancels after retry sequence ends
  • Recharge platforms benefit from tailored retry strategies and audits

More from Thursday 5 November →