Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Memory Leak

Open
#32 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
bun, deno, javascript
Domain
cryptography

Research direction

Reproduce the reported heap growth by calling createHmac in Bun and Deno, comparing it with the property-deletion workaround. Inspect Legacy.js and the package's dependency behavior first; done means repeated HMAC calls no longer show the reported memory increase without requiring manual property deletion.

Written by the indexing model from the issue text.

Description

Hi everyone, I've used this package in Bun (where it is used as part of the crypto module) and in Deno (importing it manually with npm:create-hmac).

Through using it and measuring performance, I noticed that this library creates memory leak when used as so:

const tokenString = `${secret}:${timestamp}`;

 const hmac = createHmac("md5", secret);
 const token = hmac.update(tokenString).digest("hex");
  
  return {
    token,
    timestamp: timestamp,
  };

despite the hmac getting freed from the scope and not stored in any global object / event handler, I could notice that the memory of the project would increased significantly. My test was calling this function once per second, and log the heapsize every 30s. Nothing else was happening in the code. Yet the memory increased every time (5MB for every 30s measurement).

However, the following code does not generate the memory leak:

 const tokenString = `${secret}:${timestamp}`;

  const hmac = createHmac("md5", secret);
  const token = hmac.update(tokenString).digest("hex");

  for (const property in hmac) {
    delete hmac[property as keyof typeof hmac];
  }

  return {
    token,
    timestamp: timestamp,
  };

I'm not sure if the issues lies in your own code (could not see anything incriminating in Legacy.js), or in a dependency you are using, but it is certainly there. I'm also not sure there is anything you can do about it as you need to support the nodeJS crypto signature so it's not like you can add a destroy function.

But I figured it was worth raising as an issue with this working solution in case anyone else falls down the same rabbit hole.

Dominant language
JavaScript
Stars
60
Forks
22
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from browserify/createHmac

All issues in browserify/createHmac

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.