Node.js Buffer Allocation: Pools & Memory Safety

[giscus[bot]]

Node.js Buffer Allocation: Pools & Memory Safety

How Buffer.alloc, Buffer.allocUnsafe, Buffer.from, slab pooling, and large Buffer allocation affect memory safety and performance in Node.js.

https://www.thenodebook.com/buffers/allocation-patterns

[aryan083]

Hi @ishtms I've a little doubt you've written here that Buffer.alloc() can use internal 8KB buffer pool but in the offical node documentation it is said that it will never use the intern poll https://nodejs.org/api/buffer.html#static-method-bufferallocunsafesize, can you help me figure this out?
thank you

[ishtms]

Hi @aryan083, you're right. That line isn't correct as Buffer.alloc() does not use the internal Buffer pool. The pool is used by small Buffer.allocUnsafe(), Buffer.from(string), Buffer.from(array), and Buffer.concat() allocations.

Good thing, I also found an issue with the line regarding slab reuse, as Node doesn't mark individual freed slices as reusable inside the active pool. Thanks for catching this.

[yudin-s]

Your reading of the Node docs is correct: Buffer.alloc() itself should not use the internal pool.

The distinction I would make in the article is:

Buffer.alloc(size)
  -> zero-filled
  -> never uses the internal Buffer pool

Buffer.allocUnsafe(size)
  -> not zero-filled
  -> may use the internal pool for small allocations

Buffer.from(array), Buffer.from(string), Buffer.concat(...)
  -> may also use the pool for small allocations in current Node versions

So if the text says Buffer.alloc() can use the 8 KB slab/internal pool, that part should be corrected.

The memory-safety point still holds, but it belongs to allocUnsafe() and pooled Buffer.from(...) / concat(...) cases, not to alloc().

The practical guidance is:

// safest for fresh writable memory
const buf = Buffer.alloc(size)

// faster, but only safe if every byte is overwritten before reading/sending
const buf = Buffer.allocUnsafe(size)

For sensitive data, I would prefer Buffer.alloc() unless profiling shows the zero-fill cost is actually relevant. If using allocUnsafe(), the invariant should be strict: never read, serialize, compare, or expose the buffer before fully writing it.

Official docs also describe this difference here: https://nodejs.org/api/buffer.html