bugfix: fix zstd module infinite loop when upstream return content-length abnormal

[drawing]

When the backend business returns a content-length exception, which the content-length is greater than the actual body size(for example, restart when the business return data is not completed), nginx will send a flush empty buffer, which will cause an infinite loop of zstd filter module.

for example, upstream return content:

HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
Content-Length: 2

a

[ThinkChaos]

Ran into this bug and can confirm this fix worked!

Would be nice to get it merged to save time for others :)

[melroy89]

Somebody merge it?

[mklooss]

this fix does not work here in combination with varnish.
when varnish sends chunkes we get an error.
without this patch everything works as expected

[mklooss]

You have to disable buffering, then everything works as expected here - with varnish

[Stensel8]

I encountered the same issue when I tried to use zstd buffering on a homeassistant proxy config. The homeassistant instance became unreachable and my nginx 1.29.3 completely froze up.

After I disabled zstd for that specific site, everything seemed going back to normal.

[ncrosty58]

Maybe this should get merged in and a new release should happen.

[dolgovas]

Is this repo still alive?

[zersh01]

we all hope so!

[lowkeypriority]

I encountered the same issue when I tried to use zstd buffering on a homeassistant proxy config. The homeassistant instance became unreachable and my nginx 1.29.3 completely froze up.

After I disabled zstd for that specific site, everything seemed going back to normal.

@Stensel8, hello!
Can you provide the file/request which caused nginx to froze up?

I have same problem with my server and can't to find out what causing freezing with enabled ZSTD.

[Stensel8]

I encountered the same issue when I tried to use zstd buffering on a homeassistant proxy config. The homeassistant instance became unreachable and my nginx 1.29.3 completely froze up.
After I disabled zstd for that specific site, everything seemed going back to normal.

@Stensel8, hello! Can you provide the file/request which caused nginx to froze up?

I have same problem with my server and can't to find out what causing freezing with enabled ZSTD.

My servers are mostly built with my own configs baked in: https://github.com/Stensel8/Scripts/tree/main/nginx

See below:

sten@sten-srv03:~$ cat /etc/nginx/conf.d/homeassistant.conf

# /etc/nginx/conf.d/homeassistant.conf 

server {
    listen 80;
    listen [::]:80;
    server_name homeassistant-domain.nl;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    listen 443 quic;
    listen [::]:443 quic;

    http2 on;
    http3 on;

    server_name homeassistant-domain.nl;

    # CRITICAL FIX: Disable zstd for Home Assistant
    zstd off;
    gzip off;  # Disable compression entirely voor HA

    ssl_certificate     /etc/letsencrypt/live/homeassistant-domain.nl/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/homeassistant-domain.nl.nl/privkey.pem;

    ssl_stapling off;
    ssl_stapling_verify off;

    quic_retry on;
    quic_gso on;

    add_header Alt-Svc 'h3=":443"; ma=86400' always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "no-referrer" always;

    client_max_body_size 50M;

    location / {
        proxy_pass http://192.168.0.54:8123;
        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';

        proxy_read_timeout 90m;   # Lange timeout terug
        proxy_connect_timeout 10s;
        proxy_send_timeout 90m;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_buffering off;
        proxy_redirect off;
    }
}

sten@sten-srv03:~$

@lowkeypriority, these are some earlier outputs from my nginx reverse proxy server which completely froze up. The issue was only happening when trying to compress proxied requests with the zstd module for nginx.

The fix for me was disabling zstd on proxied hosts:

    # CRITICAL FIX: Disable zstd for Home Assistant
    zstd off;
    gzip off;  # Disable compression entirely voor HA

The version and modules I had at that time, were the following:

sten@sten-srv03:~$ nginx -V

nginx version: nginx/1.29.3
built by gcc 15.2.1 20251111 (Red Hat 15.2.1-4) (GCC) 
built with OpenSSL 3.6.0 1 Oct 2025
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --pid-path=/run/nginx.pid --lock-path=/var/lock/nginx.lock --with-openssl=/root/nginx-build-20251116-160202/openssl --with-pcre=/root/nginx-build-20251116-160202/pcre2 --with-zlib=/root/nginx-build-20251116-160202/zlib --with-pcre-jit --with-http_ssl_module --with-http_v2_module --with-http_v3_module --with-http_gzip_static_module --with-http_stub_status_module --with-http_realip_module --with-http_sub_module --with-http_secure_link_module --with-stream --with-stream_ssl_module --with-stream_ssl_preread_module --with-stream_realip_module --with-file-aio --with-threads --modules-path=/etc/nginx/modules --add-dynamic-module=/root/nginx-build-20251116-160202/headers-more --add-dynamic-module=/root/nginx-build-20251116-160202/zstd-module

sten@sten-srv03:~$

The main nginx config, looked like this:
sten@sten-srv03:~$ cat /etc/nginx/nginx.conf

load_module /etc/nginx/modules/ngx_http_zstd_filter_module.so;
load_module /etc/nginx/modules/ngx_http_zstd_static_module.so;
load_module /etc/nginx/modules/ngx_http_headers_more_filter_module.so;

user nginx;
worker_processes 2;
worker_cpu_affinity auto;

error_log /var/log/nginx/error.log warn;
pid /run/nginx.pid;

worker_rlimit_nofile 8192;

events {
    worker_connections 1024;
    use epoll;
    multi_accept on;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    reset_timedout_connection on;

    # WebSocket upgrade map (nodig voor Jellyfin/Music/Status)
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }

    server_tokens off;
    more_set_headers 'Server: nginx';

    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;

    # Performance
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;

    # Compression
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml text/javascript
               application/json application/javascript application/xml+rss
               application/rss+xml font/truetype font/opentype
               application/vnd.ms-fontobject image/svg+xml;


    # SSL - TLS 1.3 ONLY
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:50m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    # HTTP/3 global
    quic_retry on;
    ssl_early_data off;

    include /etc/nginx/conf.d/*.conf;
}

I have migrated to Angie now, which I am testing out to see if I like it :)

[Stensel8]

@tokers, is this repository still active? Or will it be merged into the mainline nginx at some point?

Since the module gets older and it seems to be getting more conflicted on every new nginx release.

I reallly, reaaallly like the work though. ZSTD is like the best encoding we can get :)