vetkit.resilience.blocking-call-in-handler.js-handler
$FN runs synchronously inside a request handler. Node.js serves every request of the process on one thread, so while this call reads or writes a file, waits for a child process or hashes (bcrypt, scrypt and PBKDF2 take tens to hundreds of milliseconds by design), no other request is handled.
Last updated:
Suite: Production readiness
javascript, typescript
$FN runs synchronously inside a request handler. Node.js serves every request of the process on one thread, so while this call reads or writes a file, waits for a child process or hashes (bcrypt, scrypt and PBKDF2 take tens to hundreds of milliseconds by design), no other request is handled.
Category: RESILIENCE · Engine rule severity: WARNING
How to fix it
Use the asynchronous API and await it: fs.promises.readFile / writeFile / appendFile, execFile or spawn from child_process (promisified), crypto.pbkdf2 / scrypt / generateKeyPair, bcrypt.hash / compare, and the callback or stream forms of zlib. Read static files once at startup instead of on every request.
References
Source: packages/engine/rules/resilience/javascript.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.