KafkaJS Snappy Patch

A security-hardened Snappy compression codec for KafkaJS.

About this fork

This project is based on tulios/kafkajs-snappy, originally created by Túlio Ornelas. Credit and thanks go to Túlio and the original contributors for the KafkaJS Snappy codec on which this fork is built.

The purpose of this fork is to preserve the codec's simple KafkaJS integration while strengthening its security and maintaining it for current runtimes. It aims to:

• Limit decompressed output to reduce the risk of decompression bombs and excessive memory allocation.
• Reject malformed or truncated Snappy/Xerial payloads safely.
• Keep compatibility with current Node.js and KafkaJS releases.
• Minimize and pin dependencies, with automated vulnerability and supply-chain checks in CI.

The initial CVE remediation and security-hardening work for this fork was completed using Codex Goals in 9 minutes 27 seconds.

Requirements

• Node.js 22 or newer
• KafkaJS 2.x

Installation

npm install [email protected]

Configuration

Register the codec before creating a KafkaJS producer or consumer:

const { CompressionTypes, CompressionCodecs } = require('kafkajs')
const SnappyCodec = require('kafkajs-snappy-patch')

CompressionCodecs[CompressionTypes.Snappy] = SnappyCodec

The codec limits each decompressed Kafka record batch to 100 MiB by default. To use a different limit, register a configured factory:

const maxDecompressedSize = 25 * 1024 * 1024

CompressionCodecs[CompressionTypes.Snappy] = () =>
  SnappyCodec({ maxDecompressedSize })

Choose a limit that is at least as large as the biggest valid record batch your Kafka clients accept.

Security hardening

• Uses [email protected], which checks the declared uncompressed size before allocating the output buffer.
• Applies a configurable aggregate output limit to both raw Snappy streams and multi-chunk Xerial frames.
• Decompresses Xerial chunks sequentially so several chunks cannot allocate in parallel before the aggregate limit is enforced.
• Rejects truncated Xerial headers, chunk sizes, and chunk payloads.
• Uses one runtime dependency with no transitive dependencies.
• Pins npm dependencies to exact versions with SHA-512 integrity in package-lock.json and pins CI actions to immutable commit SHAs.
• Runs an exact OSV-Scanner binary, verified against its published SHA-256, for every push and pull request.
• Tests the pinning policy so floating dependency ranges and action tags fail CI.

See SECURITY.md to report a vulnerability.

Development

npm ci
npm test
npm audit --audit-level=low
osv-scanner scan source --lockfile package-lock.json
npm run test:package

Publishing

The package name is configured as kafkajs-snappy-patch and public access is set in package.json. After the development checks pass:

npm publish

npm publish runs the test suite again through prepublishOnly.

License

MIT. See LICENSE.