High CPU Usage with proxy_buffering set

[mageunic]

Hi,

I use proxy_buffering directive on some websites to avoid caching.

For some reason, when someone try to reach one of website with this directive set to off the container start to use the whole cpu ....

I have to restart the container to get a normal cpu usage

details:

I'm using podman.
Version of npmplus : 2026-01-16-r2-8ab7314-2.13.6

config :

Enable fancyindex/compression by upstream set to off

TLS :

Force HTTPS : True
HTTP/3 Support : True

here is the extra config detail added to one of these website:

  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_buffering off;
  client_max_body_size 0;
  proxy_request_buffering off;

[Zoey2936]

I'm not sure what I can say here, on the one side I don't see a down side of keeping proxy (request) buffering enabled. But still this does not look normal, but I also don't see that I can change here much since if it is an issue then it would need to be fixed in nginx. Can you confirm if it is related to buffering, so is the usage less with buffering disabled?

[mageunic]

I will give you all config details :

1. I'm running npmplus through podman on fedora 43 (x86_64 architecture).
2. I have set up Crowdsec Appsecrule and let'sencrypt dns certificate.
3. Add proxy_buffering off; to any proxy hosts settings
4. Try to access to the proxy host deployed
5. Enjoy CPU usage growing
6. Restart the container to clear the issue

I tried this directive for Nextcloud , Vault Warden , actualbudget, Bentopdf.
it happens same thing...

this thread seems to be the same issue : #2542 (reply in thread)

podman .container file (running under systemd unit):

[Unit]
After=crowdsec.service

[Container]
AutoUpdate=registry
ContainerName=npmplus
Environment=TZ=Europe/Paris ACME_EMAIL=XXXXXX DISABLE_IPV6=true NGINX_LOG_NOT_FOUND=true SKIP_IP_RANGES=true LOGROTATE=true LOGROTATIONS=3 INITIAL_ADMIN_PASSWORD=XXXXX INITIAL_ADMIN_EMAIL=XXXXXX
 Image=ghcr.io/zoeyvid/npmplus:latest
GlobalArgs=--log-level=error
Network=systemd-npmplus
IP=10.89.0.X
PidsLimit=5000
PublishPort=X:81
PublishPort=80:80
PublishPort=443:443
Volume=/XXX:/data
Volume=/var/www:/var/www
Volume=/opt/cubecoders/amp/shared/:/opt/cubecoders/amp/shared/:ro

[Service]
Restart=on-failure

[Install]
WantedBy=multi-user.target

npmplus network file (specific for running under systemd units with podman)

[Network]
Driver=bridge
Gateway=10.XX.0.1
IPAMDriver=host-local
PodmanArgs=--interface-name podman1
Subnet=10.XX.0.0/24

Crowdsec.conf:

ENABLED=true
API_URL=http://XXXXXX
API_KEY=XXXXX
CACHE_EXPIRATION=1
# bounce for all type of remediation that the bouncer can receive from the local API
BOUNCING_ON_TYPE=all
FALLBACK_REMEDIATION=ban
REQUEST_TIMEOUT=1000
UPDATE_FREQUENCY=10
# By default internal requests are ignored, such as any path affected by rewrite rule.
# set ENABLE_INTERNAL=true to allow checking on these internal requests.
ENABLE_INTERNAL=false
# live or stream
MODE=live
# exclude the bouncing on those location
EXCLUDE_LOCATION=
#those apply for "ban" action
# /!\ REDIRECT_LOCATION and RET_CODE can't be used together. REDIRECT_LOCATION take priority over RET_CODE
BAN_TEMPLATE_PATH=/data/crowdsec/ban.html
REDIRECT_LOCATION=
RET_CODE=444
#those apply for "captcha" action
#valid providers are recaptcha, hcaptcha, turnstile
CAPTCHA_PROVIDER=recaptcha
# Captcha Secret Key
SECRET_KEY=XXXX
# Captcha Site key
SITE_KEY=XXXX
CAPTCHA_TEMPLATE_PATH=/data/crowdsec/captcha.html
CAPTCHA_EXPIRATION=3600

APPSEC_URL=http://XXXX
APPSEC_FAILURE_ACTION=ban
APPSEC_CONNECT_TIMEOUT=1000
APPSEC_SEND_TIMEOUT=30000
APPSEC_PROCESS_TIMEOUT=10000
ALWAYS_SEND_TO_APPSEC=false
SSL_VERIFY=true

proxy host :

[Zoey2936]

can you try again with crowdsec disabled?

[ncrosty58]

I'm getting CPU max out now with any of my services that had the web sockets toggled on. Web sockets button is gone now

[ncrosty58]

Max out happens with crowdsec disabled

[mageunic]

tested on my side (with crowdsec disabled) , nothing change .... CPU usage growing singificantly for each request made ...

[MilesTEG1]

Hello
I'm having the exact same problem with my proxy host for Plex Media Server.
I have set some custom setting, and especially this line:

proxy_buffering off;

When it isn't commented, CPU get 100% usage, causing the reverse proxy mafunctionning...
When I comment this line, CPU decrease to 25 %.

Before the new version 2026, there was no problems with this line...

[MilesTEG1]

you can set the log format after the path, the logformat npmplus use sis called alog so a line would look like this: access_log /data/nginx/logs/access.log alog;

(but also note that your custom log folder will not be rotated by npmplus)

Hello 👋🏻
Sorry for the delay of this answer... I just got out of a bad flu...
I just try to add alog at the end of the access_log line:

# Logs personnalisés
access_log /data/nginx/apps-exposed/audiobookshelf-access.log alog;
error_log /data/nginx/apps-exposed/audiobookshelf-error.log alog;

And immediately after saving, the domain got offline...

Do you have an idea what go wrong?
Thanks in advance

edit:
oh! I found out that adding alog for the error-log is a bad idea!
just after removing this for this line, the domain get back online :)
False alarm ^^
So, just do this:

# Logs personnalisés
access_log /data/nginx/apps-exposed/audiobookshelf-access.log alog;
error_log /data/nginx/apps-exposed/audiobookshelf-error.log;

works fine.

[Zoey2936]

https://nginx.org/en/docs/ngx_core_module.html#error_log error log does not support log formats only error levels, alog should only be set for access logs

[MilesTEG1]

https://nginx.org/en/docs/ngx_core_module.html#error_log error log does not support log formats only error levels, alog should only be set for access logs

Yeah, that's what I learned 😅

Another question around this. If I set two access_log files, my custom, and the standard one:

# Logs personnalisés
access_log /data/nginx/apps-exposed/syno-drive-access.log alog;
error_log /data/nginx/apps-exposed/syno-drive-error.log;

# Logs de base
access_log /data/nginx/access.log;
error_log /data/nginx/error.log;

Must I set the alog format for access_log /data/nginx/access.log;?

[Zoey2936]

yes but the standard logs are in /data/nginx/logs

[MilesTEG1]

yes but the standard logs are in /data/nginx/logs

Oh indeed, the path changed since a recent update :) I'll change it too :)
And add the alog too.

[ncrosty58]

for me, my use cases don't require the option at all. I just removed it and am moving on. Just chiming in here as a data point that the issue with that option only appeared recently

[Zoey2936]

I try to reproduce this and fix this, please give me some time

[CookieCr2nk]

I noticed that the CPU Bug appears, when there is a upstream host which cant be reachable.

[Zoey2936]

I can confirm this, it seems to be related to zstd.

this does not work:

proxy_buffering off;

this works:

proxy_buffering off;
zstd off;

[Zoey2936]

I will try to patch the zstd module to fix this, but it would be good if someone else can also confirm this

[ncrosty58]

I will try to patch the zstd module to fix this, but it would be good if someone else can also confirm this

For my simple example, I can confirm that zstd off stops the issue

[CookieCr2nk]

Thanks, for me the workarround also seems to be working.

[Zoey2936]

I fixed this by applying this patch: tokers/zstd-nginx-module#23
You can expect a fixed release today

[Zoey2936]

sorry it takes one day more, I try to release it today