Investigating Potential Memory Leaks in Bun's Zero‑Copy HTTP Server

Answer to the Core Questions

1. Buffer reuse policy and leak risk
   Bun’s zero‑copy server pools Buffer objects on a per‑connection basis. The runtime documentation states that a buffer is returned to the pool once the request lifecycle completes, provided the request body has been fully consumed and no external reference remains. If a handler returns a Buffer or stores it in a global structure without draining it, the buffer stays in the pool, leading to a gradual RSS increase.
2. Reliable leak detection
   Run a sustained load test with wrk while watching RSS via top or htop. A steady‑state RSS indicates correct buffer recycling; a linear, non‑plateauing rise signals a leak. For finer granularity, capture heap snapshots with bun --dump-heap before and after the test, or profile with massif.
3. Mitigation strategies
   
   • Ensure request handlers fully read the body (e.g., await request.text() or await request.arrayBuffer()) before responding.
   • Avoid returning raw Buffer objects; instead, convert to Uint8Array or string if you need to preserve the data.
   • Keep the handler scope tight; do not store buffers in module‑level arrays or closures that outlive the request.
   • If you must keep a buffer, manually release it by calling buffer.release() (if exposed) or replace it with a fresh buffer once the request is done.
   • Use --no-std or other runtime flags to reduce GC pressure if available in future releases.

Practical Steps for Your Test Environment

1. Start the server:

   bun serve --port 3000 --watch
   // Simple echo handler
   Bun.serve({
     fetch(req) {
       return new Response(req.body);
     }
   });
   

2. Run a sustained load test (example: 200 concurrent connections for 5 minutes):

   wrk -t8 -c200 -d5m http://127.0.0.1:3000/
   

3. While wrk runs, open another terminal and monitor RSS:

   top -p $(pidof bun) -d 1
   

   Observe whether RSS stabilizes or keeps climbing.
4. After the test, capture a heap snapshot:

   bun --dump-heap > before.heap
   # Repeat the load test
   bun --dump-heap > after.heap
   

   Compare the number of Buffer objects in each file.
5. Optional: use massif for native memory profiling:

   massif --tool=massif --output=massif.out $(pidof bun)
   # After load test, run
   massif-analyze massif.out
   

What We Still Need to Know

If your handlers sometimes return raw buffers or store them beyond the request scope, the recommendation above changes. Please confirm whether any part of your code keeps a reference to the request body after the response is sent. This detail determines whether the leak is due to misuse or an internal bug.

Assumptions and Uncertainty

• These observations are based on Bun 1.0.0‑stable (as of 2026‑10‑18). Future releases may alter the buffer pool implementation.
• The bun --dump-heap flag captures JavaScript heap objects but may miss native allocations, so a complete leak picture requires complementary tools like massif.
• Other factors (OS caching, other processes) can affect RSS; isolate the test environment for accurate results.