Flooding requests results in memory leak

Hello,

Using the built-in http and https packages causes a memory leak when the server gets flooded with requests from different IPs which eventually crashes the server.

Code

const express = require('express');
const fs = require('fs');
const http = require('http');
const https = require('https');

const app = express();

app.enable('trust proxy');

app.all('*', (req, res) => {
  return res.send({
    message: 'Hello World!'
  });
});

const privateKey = fs.readFileSync('/etc/letsencrypt/live/.../privkey.pem', 'utf8');
const certificate = fs.readFileSync('/etc/letsencrypt/live/.../cert.pem', 'utf8');
const ca = fs.readFileSync('/etc/letsencrypt/live/.../chain.pem', 'utf8');
const credentials = {
    key: privateKey,
    cert: certificate,
    ca: ca
};

const httpServer = http.createServer(app);
const httpsServer = https.createServer(credentials, app);

httpServer.listen(80, () => {
    console.log('HTTP Server running on port 80');
});

httpsServer.listen(443, () => {
    console.log('HTTPS Server running on port 443');
});

Error

(node:14043) MaxListenersExceededWarning: Possible EventEmitter memory leak detected. 11 error listeners added to [TLSSocket]. Use emitter.setMaxListeners() to increase limit

[dougwilson]

What I have debugged so far in Node.js is that the case seems to be a flaw in the logic of that internal socketOnError function. When it is called, it removes itself from the list of error listeners and then adds a new error listener, noop. It seems that at some point, that listener was thw only way socketOnError was invoked. But you will find in their code there are now multiple places in which socketOnError is invoked, and removing that error listener doesn’t stop them all. Additional invokations for the same socket keep adding that noop listener, and the state at which the warning happens, there are 10 noop listeners on the socket, and the warning happens when the 11th noop listener is added.

[dougwilson]

Hm, very strange.I was able to reproduce on both. But in Express.js code, nothinf is adding the error listener that is leaking with the warning. That event listener is being added by Node.js itself, before the request is ever even handed to Express.js. It is unclear how Express.js can fix the issue you have provided, as the code it all within the Node.js code base and not Express.js…

https://github.com/nodejs/node/blob/e339e9c5d71b72fd09e6abd38b10678e0c592ae7/lib/_http_server.js#L749