Reliability JavaScript active http-service

Request-path code does not block the event loop and preserves backpressure

rel-javascript-001

Intent

Prevent Node.js request handling from stalling unrelated work or buffering more data than downstream consumers can absorb.

Applicability

Applies to Node.js request handlers, middleware, and stream wiring.

What to inspect

*Sync APIs in request paths, heavy synchronous work, stream piping, and backpressure handling.

Pass criteria

Request-path work uses async APIs and stream wiring preserves backpressure.

Fail criteria

The diff introduces synchronous blocking work on the main event loop or stream handling that ignores backpressure.

Do not flag

Startup code and worker-thread code isolated from the main request loop.

Confidence guidance

HIGH when the blocking call or broken stream wiring is directly visible. MEDIUM when the helper is only used from request code. LOW when execution context is unclear.

Remediation

Use non-blocking APIs and preserve stream backpressure instead of buffering or synchronous processing.

Pass example

source.pipe(transform).pipe(dest)

Fail example

const data = fs.readFileSync(path)

Sources

  • Matteo Collina's blog & talks article
  • OWASP NodeGoat + OWASP Node.js Security Cheat Sheet standard