Memory Leak in Feathersjs with Cockroachdb

A memory leak in a Feathersjs service using Cockroachdb typically arises from unbounded data retention in application-layer objects and from how database clients manage result sets and connections. Feathersjs services often stream query results or accumulate data in service methods and hooks without explicit cleanup. When combined with Cockroachdb, which uses a PostgreSQL-wire protocol, the patterns that cause leaks are similar to PostgreSQL drivers, but the orchestration in a Node.js service can amplify retention if cursors or rows are not released promptly.

Memory leaks in this stack can be triggered by long-running queries, large result sets, or repeated calls to a service that do not release references. For example, if a Feathers hook stores query rows in an array for later processing and never clears or limits that array, the heap grows over time. Additionally, Cockroachdb connections from a driver such as pg (used under the hood by many Feathers adapters) must be properly released; failing to return clients to the pool or leaving result sets unread can hold onto memory on both the Node.js process and the database side.

In a black-box scan by middleBrick, unauthenticated checks for Rate Limiting and Unsafe Consumption can surface indicators of resource exhaustion, while the Data Exposure and Property Authorization checks may reveal endpoints returning large payloads that, when mishandled, contribute to retention. The scanner’s Inventory Management and Input Validation checks can further highlight endpoints where unbounded input leads to unbounded in-memory structures when paired with Cockroachdb queries that lack pagination or result-size controls.

Real-world patterns include:

• Streaming queries without consuming or closing the stream, leaving internal buffers intact.
• Using global or long-lived caches keyed by request parameters that grow without eviction policies.
• Not closing cursors or failing to iterate/finalize results in custom service logic.

These become critical when services are deployed in environments with many concurrent connections, as retained memory per connection multiplies across requests. middleBrick’s LLM/AI Security checks do not directly assess memory leaks, but its focus on unsafe consumption and input validation can help identify endpoints that may contribute to retention risks when integrated with Cockroachdb.

Remediation centers on strict resource lifecycle management, pagination, and avoiding accumulation of rows in service state. Use Feathers hooks to enforce limits and ensure database cursors and clients are released even on errors.

Example: A service method that streams results should consume and close the stream explicitly, and avoid attaching large result sets to the service context.

const { Pool } = require('pg');
const pool = new Pool({ connectionString: process.env.DATABASE_URL });

app.use('/tickets', {
  async find(params) {
    const client = await pool.connect();
    try {
      const cursor = client.query('SELECT id, title, status FROM tickets WHERE account_id = $1', [params.accountId]);
      const rows = [];
      for await (const row of cursor) {
        // Process row in a streaming fashion; do not accumulate unboundedly
        if (row.status !== 'archived') {
          rows.push({ id: row.id, title: row.title });
        }
      }
      return rows;
    } finally {
      client.release();
    }
  }
});

Use pagination with limit/offset or keyset pagination to bound result sizes:

app.use('/reports', {
  async find(params) {
    const { page = 1, pageSize = 50, accountId } = params.query;
    const offset = (page - 1) * pageSize;
    const client = await pool.connect();
    try {
      const res = await client.query(
        'SELECT id, amount, created_at FROM transactions WHERE account_id = $1 ORDER BY created_at DESC LIMIT $2 OFFSET $3',
        [accountId, pageSize, offset]
      );
      return res.rows;
    } finally {
      client.release();
    }
  }
});

In Feathers hooks, clean up references and avoid storing per-request data in service properties:

module.exports = function () {
  return async context => {
    // BAD: context.app.set('temp', largeArray); // leaks across requests
    // GOOD: keep transient data local to the hook
    const transformed = await transformRows(context.result.rows);
    context.result = transformed;
    return context;
  };
};

Configure the Feathers adapter to enforce timeouts and ensure Cockroachdb connections are returned to the pool promptly. Monitor open file descriptors and active queries via Cockroachdb’s built-in instrumentation to correlate with Node.js heap usage. middleBrick’s Pro plan includes continuous monitoring, which can help detect gradual increases in memory usage across deployments and correlate findings with CI/CD gates via the GitHub Action.