Memory leak in v1.4.0 due to webhook timeouts (heap grows to 7GB+)

[forestuser]

Outline version: 1.4.0 (Node.js v22.21.0)

Problem: Node.js process memory grows uncontrollably until crash with FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed. Memory spikes up to 7GB+ before OOM.

Root cause: Webhook tasks timeout and leak resources. Each documents.update triggers DeliverWebhookTask - if endpoint is unresponsive (404/timeout), objects stay in memory.

Logs before crash:

text
{"error":"Request timeout after 5000ms","level":"error","message":"Failed to send webhook"}

<--- Last few GCs --->
[41:0x766b000] 91243 ms: Mark-Compact 4094.7 -> 4093.5 MB

FATAL ERROR: Ineffective mark-compacts near heap limit - JavaScript heap out of memory
Memory progression:

Normal: ~300-500 MB

Peak before crash: 7GB+

Docker stats showed constant growth until limit

Fix: Delete the webhook

After fix: Memory stable at ~800 MB.

Expected behavior: Timeouts should properly clean up resources (sockets, promises, event listeners) instead of leaking.

[tommoor]

Sounds like you fixed it, why not submit as an issue or PR?

[forestuser]

Yes, deleting the webhook fixed it for me, but that’s just a workaround, not a fix.

The real issue is that DeliverWebhookTask doesn’t clean up resources when a webhook request times out. In my logs, I saw repeated errors like:

json
{"error":"Request timeout after 5000ms","level":"error","message":"Failed to send webhook","stack":"Error: Request timeout after 5000ms\n at fetch (/opt/outline/build/server/utils/fetch.js:86:13)\n at async DeliverWebhookTask.sendWebhook (/opt/outline/build/plugins/webhooks/server/tasks/DeliverWebhookTask.js:536:18)"}
Each timeout leaves something in memory (probably promises, sockets, or event listeners) that never gets released. Over time, heap usage grows until it hits the limit and crashes with FATAL ERROR.

I’m not saying Outline is bad — I understand that long-running Node.js processes require careful resource management, but in this case, the webhook task should guarantee cleanup (e.g., using finally, AbortController, or destroying sockets).

If another user has a misconfigured webhook (like I did), they’ll hit the same issue. Deleting it works, but the real fix should be in the code — the task must not leak memory when the endpoint is unreachable.

So yeah, I "fixed it" for myself, but the underlying bug is still there. That’s why I’m reporting it.

[tommoor]

I see that your fix was deleting the webhook now, I misread that you had implemented a fix in the code 👍

[tommoor]

Fixed here #11580 – will be in the next release.