Buffers Best Practices

Buffers are the right tool for small, known-size binary work - for everything else, cap sizes, prefer streams, and treat encoding and secrets explicitly.

How to Use This List

• Apply to upload handlers, webhooks, TCP parsers, and crypto utilities.
• Any unchecked item is a blocker for paths accepting untrusted bytes.
• Pair with Streams Best Practices for large I/O.
• Security items are mandatory for auth and payment flows.

A - Size and Memory

• Stream files larger than a few MB instead of readFile into one Buffer. Constant memory under load.
• Enforce MAX_FRAME or body size limits on binary parsers. Reject oversize length prefixes before allocation.
• Pre-size Buffer.concat when total length is known. Avoid O(n²) realloc on many chunks.
• Avoid accumulating unbounded chunk arrays from sockets. Parse incrementally or use Transform streams.
• Monitor heap when handling uploads. Alert on growth correlated with traffic.

B - Allocation and Encoding

• Use Buffer.alloc for secrets and crypto material. Not allocUnsafe unless immediately overwritten fully.
• Specify utf8 explicitly in toString/from for text. Document legacy encodings in ADR if unavoidable.
• Use TextDecoder with fatal: true for inbound text protocols. Reject malformed sequences at boundary.
• Normalize Unicode (NFC) before comparison of user identifiers. Prevents homograph bypass.
• Use Buffer.byteLength for UTF-8 size limits. Not string .length.

C - Security

• Compare secrets with crypto.timingSafeEqual on equal-length digests. No raw === on API keys.
• Never echo buffer contents in errors or logs. Generic client messages; server-side correlation IDs.
• Wipe short-lived key buffers in finally when feasible. buffer.fill(0) best-effort hygiene.
• Parse HMAC/signatures on raw body Buffer before JSON parse. Preserve byte-exact payload for verify.
• Cap hex/base64 decode output size. Prevent decompression bombs.

D - Protocols and Interop

• Document endianness and frame layout in protocol spec. Big-endian unless stated otherwise.
• Handle partial TCP reads with an accumulator. Never assume data event equals one message.
• Version binary message types or use protobuf/msgpack schemas. Evolvable contracts.
• Prefer subarray over slice for zero-copy views. Copy when retaining beyond next read.
• Use Web-standard TextEncoder/Uint8Array at fetch boundaries. Interop with browser clients.

E - When Not to Use Buffers

• Do not represent domain objects as raw Buffers in business logic. Parse to typed structures at boundary.
• Do not use Buffers for numbers - use typed arrays or protobuf. Clear schema beats ad-hoc bytes.
• Do not stringify binary as latin1 for "preservation". Explicit hex/base64 with size limits instead.
• Reach for streams when transforming large payloads. gzip, CSV parse, S3 upload pipelines.
• Reach for JSON when debuggability beats byte efficiency. Binary only with measured need.

FAQs

Related

• Buffers Basics - core APIs
• Buffer Security - timing-safe compare
• Streams Best Practices - large data paths
• Binary Protocols - framing patterns

Stack versions: This page was written for Node.js 24.18.0 (Active LTS), npm 10+, TypeScript 5.6+, Express 5, Fastify 5, and NestJS 11.