{"record":{"id":"bb0977e52d320207","repo":"oven-sh/bun","slug":"out-of-mem","errorCode":"OUT_OF_MEM","errorMessage":"OUT_OF_MEM","messagePattern":"OUT_OF_MEM","errorType":"error_code","errorClass":"CertError","httpStatus":null,"severity":"critical","filePath":"src/http/error.rs","lineNumber":155,"sourceCode":"    #[error(\"CRL_SIGNATURE_FAILURE\")]\n    CRL_SIGNATURE_FAILURE,\n    #[error(\"CERT_NOT_YET_VALID\")]\n    CERT_NOT_YET_VALID,\n    #[error(\"CERT_HAS_EXPIRED\")]\n    CERT_HAS_EXPIRED,\n    #[error(\"CRL_NOT_YET_VALID\")]\n    CRL_NOT_YET_VALID,\n    #[error(\"CRL_HAS_EXPIRED\")]\n    CRL_HAS_EXPIRED,\n    #[error(\"ERROR_IN_CERT_NOT_BEFORE_FIELD\")]\n    ERROR_IN_CERT_NOT_BEFORE_FIELD,\n    #[error(\"ERROR_IN_CERT_NOT_AFTER_FIELD\")]\n    ERROR_IN_CERT_NOT_AFTER_FIELD,\n    #[error(\"ERROR_IN_CRL_LAST_UPDATE_FIELD\")]\n    ERROR_IN_CRL_LAST_UPDATE_FIELD,\n    #[error(\"ERROR_IN_CRL_NEXT_UPDATE_FIELD\")]\n    ERROR_IN_CRL_NEXT_UPDATE_FIELD,\n    #[error(\"OUT_OF_MEM\")]\n    OUT_OF_MEM,\n    #[error(\"DEPTH_ZERO_SELF_SIGNED_CERT\")]\n    DEPTH_ZERO_SELF_SIGNED_CERT,\n    #[error(\"SELF_SIGNED_CERT_IN_CHAIN\")]\n    SELF_SIGNED_CERT_IN_CHAIN,\n    #[error(\"UNABLE_TO_GET_ISSUER_CERT_LOCALLY\")]\n    UNABLE_TO_GET_ISSUER_CERT_LOCALLY,\n    #[error(\"UNABLE_TO_VERIFY_LEAF_SIGNATURE\")]\n    UNABLE_TO_VERIFY_LEAF_SIGNATURE,\n    #[error(\"CERT_CHAIN_TOO_LONG\")]\n    CERT_CHAIN_TOO_LONG,\n    #[error(\"CERT_REVOKED\")]\n    CERT_REVOKED,\n    #[error(\"INVALID_CA\")]\n    INVALID_CA,\n    #[error(\"PATH_LENGTH_EXCEEDED\")]\n    PATH_LENGTH_EXCEEDED,\n    #[error(\"INVALID_PURPOSE\")]","sourceCodeStart":137,"sourceCodeEnd":173,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L137-L173","documentation":"X509 verify result 17 (X509_V_ERR_OUT_OF_MEM): BoringSSL/X.509 verification ran out of memory while building or verifying the chain. Mapped via get_cert_error_from_no (src/http/lib.rs:1536) to CertError::OUT_OF_MEM. Unlike the sibling variants, this is a resource failure, not a trust decision.","triggerScenarios":"TLS handshake on a process at its memory ceiling — very large chains (hundreds of intermediates, adversarial servers), or the process/container already near its RSS/cgroup limit when verification allocates.","commonSituations":"Containers with tight memory limits (cgroup OOM pressure), memory leaks elsewhere leaving no headroom, or malicious/broken servers presenting pathological chains.","solutions":["Raise the container/process memory limit or free memory before retrying","Profile for leaks — the TLS verification itself needs only a few KB","If a specific server triggers it with an enormous chain, that server is broken or hostile; avoid/fix it","Retry once after GC/memory relief — a transient OOM clears"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// guard headroom before starting TLS-heavy batches\nfunction assertMemoryHeadroom(minFreeBytes = 64 * 1024 * 1024) {\n  const { rss, systemMemory } = Bun.memoryUsage ? { ...Bun.memoryUsage, systemMemory: 0 } : { rss: 0, systemMemory: 0 };\n  const pages = Bun.syscall ? null : null; // keep it simple: rely on cgroup/container limits externally\n  if (rss > Number(process.env.MAX_RSS_BYTES ?? Infinity) - minFreeBytes) {\n    throw new Error(\"Insufficient memory headroom for TLS workload\");\n  }\n}","typeGuard":"function isCertErrorCode(e: unknown, code = \"OUT_OF_MEM\"): e is Error & { code: string } {\n  return e instanceof Error && (e as any).code === code;\n}","tryCatchPattern":"async function fetchWithMemRetry(url: string, tries = 2) {\n  for (let i = 0; ; i++) {\n    try {\n      return await fetch(url);\n    } catch (e) {\n      if (i < tries && isCertErrorCode(e, \"OUT_OF_MEM\")) {\n        Bun.gc(true); // free memory, then retry once\n        continue;\n      }\n      throw e;\n    }\n  }\n}","preventionTips":["Set container memory limits with headroom above observed peak RSS","Watch for leaks with Bun.memoryUsage.rss dashboards; verification OOM is a symptom, not the cause","Avoid/fix servers that present pathological chains (hundreds of certs)"],"tags":["tls","memory","resources","fetch"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}