Skip to content

No explicit connection pool size #50

@jeesunikim

Description

@jeesunikim
  • Location: src/utils/connect.ts:93, src/utils/connect.ts:132
  • Vulnerability: Prisma defaults to num_cpus * 2 + 1 connections. In a container with 1 vCPU, that's only 3 connections. Under sustained load, this is easily exhausted.
  • Exploit scenario: An attacker sends bursts of requests just under the rate limit (1000/15min = ~1.1/sec). With only 3 pool connections and no statement timeout, even moderate query latency causes queuing and eventual timeouts.
  • Impact: API becomes unresponsive under moderate load.
  • Suggested fix: Set pool size explicitly via the connection URL: postgresql://...?connection_limit=20

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    Status

    Backlog (Not Ready)

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions