Overview
src/security/threats/threat-detection.service.ts uses private failedAttempts = new Map<string, number>() with no TTL or eviction. An IP-rotation attack or a large user base will cause this Map to grow indefinitely, eventually consuming all heap memory and triggering OOM kills across pod restarts. This is a distinct issue from the distributed-state problem (tracked separately) — this bug exists even in a single-instance deployment.
Specifications
Features:
- Replace the unbounded Map with a bounded, TTL-based structure even before Redis migration.
Tasks:
- As an interim fix, replace the
Map with an lru-cache instance capped at 50,000 entries and a 15-minute TTL per entry.
- Log a warning when the LRU eviction is triggered (indicating the cap was hit).
- Add a unit test that inserts 50,001 entries and verifies the oldest is evicted.
Impacted Files:
src/security/threats/threat-detection.service.ts
Acceptance Criteria
- Map size is bounded at 50,000 entries.
- Entries expire after 15 minutes without manual reset.
- Unit test verifies LRU eviction at the cap boundary.
Overview
src/security/threats/threat-detection.service.tsusesprivate failedAttempts = new Map<string, number>()with no TTL or eviction. An IP-rotation attack or a large user base will cause this Map to grow indefinitely, eventually consuming all heap memory and triggering OOM kills across pod restarts. This is a distinct issue from the distributed-state problem (tracked separately) — this bug exists even in a single-instance deployment.Specifications
Features:
Tasks:
Mapwith anlru-cacheinstance capped at 50,000 entries and a 15-minute TTL per entry.Impacted Files:
src/security/threats/threat-detection.service.tsAcceptance Criteria