Memory leak in Node.js server caused by rapid UDP endpoint roaming (LTE/CGNAT) #132

New Issue

MrUnknownDE · 2026-04-05T17:01:19+02:00

MrUnknownDE commented

2026-04-05 17:01:19 +02:00

Originally created by @cmmrandau on 3/11/2026

Describe the Bug

The Pangolin Node.js process is experiencing a memory leak, eventually consuming almost all available host RAM (reached 5.8 GiB in my case).

The issue appears to be tied to endpoint roaming/port changes. I have a newt client running on an LTE network in a Docker container. Because of the cellular provider's aggressive CGNAT, the UDP connection drops exactly every 60 seconds, and the client reconnects on a new port.

While WireGuard natively handles this endpoint roaming fine, the Pangolin server appears to be holding onto every single dead connection state instead of garbage-collecting them. Over 5 days, at 1,440 port changes a day, the Node process memory slowly balloons until the system runs out of RAM.

(please forgive me for using AI to write the report)

Environment

OS Type & Version: Ubuntu 24.04
Pangolin Version: 1.16.2 EE
Gerbil Version: 1.30
Traefik Version: 3.69
Newt Version:1.10.2

To Reproduce

Run a newt client behind an aggressive CGNAT or LTE connection that forces a port change frequently (or artificially force the client to change its source port every 60 seconds).

Monitor the Pangolin server logs; observe the constant [info]: Site X endpoint changed from IP:PORT to IP:NEW_PORT messages.

On the newt client side: lots of INFO: 2026/03/11 01:10:25 TCP Forwarder: Successfully connected to 172.18.0.7:3553, starting bidirectional copy

Monitor the Pangolin node process RAM usage via top or btop.

Observe the memory usage steadily climbing without ever releasing.

Expected Behavior

When a WireGuard endpoint roams and changes its port, Pangolin should update the tunnel's active endpoint and immediately discard/garbage-collect the old connection state from memory.

*Originally created by @cmmrandau on 3/11/2026* ### Describe the Bug The Pangolin Node.js process is experiencing a memory leak, eventually consuming almost all available host RAM (reached 5.8 GiB in my case). The issue appears to be tied to endpoint roaming/port changes. I have a newt client running on an LTE network in a Docker container. Because of the cellular provider's aggressive CGNAT, the UDP connection drops exactly every 60 seconds, and the client reconnects on a new port. While WireGuard natively handles this endpoint roaming fine, the Pangolin server appears to be holding onto every single dead connection state instead of garbage-collecting them. Over 5 days, at 1,440 port changes a day, the Node process memory slowly balloons until the system runs out of RAM. (please forgive me for using AI to write the report) ### Environment - OS Type & Version: Ubuntu 24.04 - Pangolin Version: 1.16.2 EE - Gerbil Version: 1.30 - Traefik Version: 3.69 - Newt Version:1.10.2 ### To Reproduce Run a newt client behind an aggressive CGNAT or LTE connection that forces a port change frequently (or artificially force the client to change its source port every 60 seconds). Monitor the Pangolin server logs; observe the constant [info]: Site X endpoint changed from IP:PORT to IP:NEW_PORT messages. On the newt client side: lots of INFO: 2026/03/11 01:10:25 TCP Forwarder: Successfully connected to 172.18.0.7:3553, starting bidirectional copy Monitor the Pangolin node process RAM usage via top or btop. Observe the memory usage steadily climbing without ever releasing. ### Expected Behavior When a WireGuard endpoint roams and changes its port, Pangolin should update the tunnel's active endpoint and immediately discard/garbage-collect the old connection state from memory.

MrUnknownDE added the stale stale stale stale stale labels 2026-04-05 17:01:19 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label stale stale stale stale stale

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#132