lib/msgpack.js concatenates self.buf on every data with allocUnsafe(self.buf.length + d.length) and no max. Incomplete frames (kScanContinue) keep the buffer. SEND_QUEUE_CAP bounds send, not receive. close/end/error do not clear self.buf.
Oversized headers already throw and drop the buffer. Incomplete frames under ScanOne still grow.
Reject (and reset the socket) when self.buf.length + d.length would exceed a documented MAX_STREAM_BYTES before allocate.
lib/msgpack.jsconcatenatesself.bufon everydatawithallocUnsafe(self.buf.length + d.length)and no max. Incomplete frames (kScanContinue) keep the buffer.SEND_QUEUE_CAPbounds send, not receive.close/end/errordo not clearself.buf.Oversized headers already throw and drop the buffer. Incomplete frames under ScanOne still grow.
Reject (and reset the socket) when
self.buf.length + d.lengthwould exceed a documentedMAX_STREAM_BYTESbefore allocate.