Bun.serve: reject disturbed ReadableStream response bodies with ERR_BODY_ALREADY_USED

[robobun]

Repro

const mk = () => new ReadableStream({ start(c) { c.enqueue(new TextEncoder().encode("HELLO")); c.close(); } });
const srv = Bun.serve({
  port: 0,
  async fetch() {
    const resp = new Response(mk());
    await resp.text();          // handler consumed the body
    // resp.bodyUsed === true
    return resp;
  },
  error(e) { return new Response("ERR:" + e.code, { status: 500 }); },
});
const r = await fetch(srv.url);
console.log(r.status, JSON.stringify(await r.text()), r.headers.get("content-length"));
// before: 200 "" 0          (error() never invoked)
// after:  500 "ERR:ERR_BODY_ALREADY_USED"
srv.stop(true);

String/Blob/Uint8Array/Response.json bodies already 500 with ERR_BODY_ALREADY_USED here (since #33118). A Response whose ReadableStream body the handler consumed was served as a silent empty 200 with Content-Length: 0, and a partially-read stream (getReader() + read() + releaseLock()) silently served only the unread remainder.

Cause

After await resp.text() on a stream body, the body stays Body::Value::Locked with action = GetText and the disturbed stream still in the Response's JS-side stream cache slot. do_render_with_body re-reads that stream via get_body_readable_stream, but the Locked arm only checked stream.is_locked(), not stream.is_disturbed(). A consumed stream is disturbed but not locked, so it fell through to do_render_stream and rendered as empty.

Fix

Check is_disturbed() on the response's ReadableStream in do_render_with_body and route to the same ERR_BODY_ALREADY_USED error-handler path as the existing Body::Value::Used arm.

Verification

Extended test/js/bun/http/serve-reused-response.test.ts to cover the stream variants (start-source, pull-source, partial-read-then-releaseLock) alongside the existing string/blob cases.

# before (system bun): 3 fail
  ReadableStream (start) body was consumed before returning  -> received ""
  ReadableStream (pull) body was consumed before returning   -> received ""
  ReadableStream body was partially read                     -> received "BBBB"
# after: 12 pass, 0 fail

---

[review] gate passed · iteration 0 · 2 files touched

fails on main (without fix)

ASAN without fix: 3 FAILED
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" test/js/bun/http/serve-reused-response.test.ts
bun test v1.4.0 (4416cc88f)

test/js/bun/http/serve-reused-response.test.ts:
(pass) returning a Response with an already-used body > returning the same string-bodied Response twice calls the error handler [43.57ms]
(pass) returning a Response with an already-used body > returning the same Uint8Array-bodied Response twice calls the error handler [23.37ms]
(pass) returning a Response with an already-used body > returning the same stream-bodied Response twice calls the error handler [31.90ms]
(pass) returning a Response with an already-used body > returning a Response whose string body was consumed before returning calls the error handler [31.65ms]
(pass) returning a Response with an already-used body > returning a Response whose Response.json body was consumed before returning calls the error handler [19.06ms]
(pass) returning a Response with an already-used body > returning a Response whose Blob body was consumed before returning calls the error handler [20.01ms]
104 |           return new 
... (truncated)

release without fix: 3 FAILED
bun test v1.4.0-canary.1 (1498d7b77)

test/js/bun/http/serve-reused-response.test.ts:
(pass) returning a Response with an already-used body > returning the same string-bodied Response twice calls the error handler [2.68ms]
(pass) returning a Response with an already-used body > returning the same Uint8Array-bodied Response twice calls the error handler [0.70ms]
(pass) returning a Response with an already-used body > returning the same stream-bodied Response twice calls the error handler [2.58ms]
(pass) returning a Response with an already-used body > returning a Response whose string body was consumed before returning calls the error handler [0.92ms]
(pass) returning a Response with an already-used body > returning a Response whose Response.json body was consumed before returning calls the error handler [0.58ms]
(pass) returning a Response with an already-used body > returning a Response whose Blob body was consumed before returning calls the error handler [0.76ms]
104 |           return new Response("handled", { status: 500 });
105 |         },
106 |       });
107 | 
108 |       const response = await fetch(server.url);
109 |       expect(await response.text()).toB
... (truncated)

passes on PR (with fix)

ASAN with fix: all passed
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" test/js/bun/http/serve-reused-response.test.ts
bun test v1.4.0 (4416cc88f)

test/js/bun/http/serve-reused-response.test.ts:
(pass) returning a Response with an already-used body > returning the same string-bodied Response twice calls the error handler [41.46ms]
(pass) returning a Response with an already-used body > returning the same Uint8Array-bodied Response twice calls the error handler [22.59ms]
(pass) returning a Response with an already-used body > returning the same stream-bodied Response twice calls the error handler [29.19ms]
(pass) returning a Response with an already-used body > returning a Response whose string body was consumed before returning calls the error handler [30.93ms]
(pass) returning a Response with an already-used body > returning a Response whose Response.json body was consumed before returning calls the error handler [17.26ms]
(pass) returning a Response with an already-used body > returning a Response whose Blob body was consumed before returning calls the error handler [18.66ms]
(pass) returning a Response
... (truncated)

release with fix: all passed
$ bun scripts/build.ts --profile=release
[configured] bun-profile → bun (stripped) in 691ms (unchanged)
ninja: Entering directory `/workspace/bun/build/release'
[1/85] gen generated_host_exports.rs
generated_host_exports.rs: 94 exports (host=3, lazy=10, generic=81, rust=0); 240 extern-C blocks audited
[1/85] cargo bun_bin → libbun_rust.a (--target x86_64-unknown-linux-gnu)

  nightly-2026-07-20-x86_64-unknown-linux-gnu unchanged - rustc 1.99.0-nightly (9f36de775 2026-07-19)

�[1m�[92m   Compiling�[0m bun_react_compiler v0.0.0 (/workspace/bun/src/react_compiler)
�[1m�[92m   Compiling�[0m bun_css v0.0.0 (/workspace/bun/src/css)
�[1m�[92m   Compiling�[0m bun_js_parser v0.0.0 (/workspace/bun/src/js_parser)
�[1m�[92m   Compiling�[0m bun_resolver v0.0.0 (/workspace/bun/src/resolver)
�[1m�[92m   Compiling�[0m bun_ini v0.0.0 (/workspace/bun/src/ini)
�[1m�[92m   Compiling�[0m bun_router v0.0.0 (/workspace/bun/src/router)
�[1m�[92m   Compiling�[0m bun_bundler v0.0.0 (/workspace/bun/src/bundler)
�[1m�[92m   Compiling�[0m bun_standalone_graph v0.0.0 (/workspace/bun/src/standalone_graph)
�[1m�[92m   Compiling�[0m bun_transpiler v0.0.0 (/workspace/bun/src/transpiler)
�[1m�[92
... (truncated)

diff hotspot

src/runtime/server/RequestContext.rs           | 14 ++++++
 test/js/bun/http/serve-reused-response.test.ts | 69 ++++++++++++++++++++++++--
 2 files changed, 80 insertions(+), 3 deletions(-)

gate history · 1 passed · 0 rejected · iteration 0

evidence per changed file

file                                            reads  edits  tests
src/runtime/server/RequestContext.rs                5      1      0
test/js/bun/http/serve-reused-response.test.ts      1      1      0

[robobun]

Status: diff is green; CI failures are unrelated to this change.

Reproduced with the repro from the report:

• /string -> 500 ERR_BODY_ALREADY_USED (already worked)
• /stream -> 200 "" cl:0 before, 500 ERR_BODY_ALREADY_USED after
• partial read + releaseLock -> 200 "BBBB" before, 500 ERR_BODY_ALREADY_USED after

CI build #83412: the only non-flaky failure is serve.test.ts "request body backpressure > releases a paused request body when the handler responds without reading it" on darwin x64, which also fails on main at the same base commit (#83238). That test returns a fresh string-body Response and never touches the Body::Value::Locked stream path this PR changes. All other failures are marked flaky and passed on retry. serve-reused-response.test.ts (the file this PR extends) passes on every lane.

[coderabbitai]

Walkthrough

Changes

Response body reuse handling

Layer / File(s)	Summary
Disturbed stream guard src/runtime/server/RequestContext.rs	Checks disturbed response streams, invokes the BODY_ALREADY_USED error path, and returns before locked-stream handling.
Consumed body coverage test/js/bun/http/serve-reused-response.test.ts	Adds parameterized coverage for consumed body types and partial ReadableStream reads, expecting the custom error response.

Suggested reviewers: jarred-sumner

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly matches the main change: Bun.serve now rejects disturbed ReadableStream response bodies with ERR_BODY_ALREADY_USED.
Description check	✅ Passed	The description covers the problem, cause, fix, and verification, which sufficiently satisfies the required PR template content.

---

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

LGTM — closes the ReadableStream gap in the existing ERR_BODY_ALREADY_USED handling from #33118.

What was reviewed:

• is_disturbed() is a plain C++ field read (stream->m_disturbed, WebStreamsExports.cpp:115) — no user-JS re-entry or exception concerns.
• Cleanup via response_body_readable_stream_ref.deinit() matches the sibling Source::Invalid early-return; is_aborted_or_ended() was already checked at the top of the Locked arm.
• Error construction and run_error_handler call are byte-identical to the existing Body::Value::Used arm.
• Tests extend the existing file with an it.each matrix (start/pull sources, partial-read+releaseLock) and assert exact error code/name/message.

Extended reasoning...

Overview

The PR adds a single is_disturbed() guard in do_render_with_body's Body::Value::Locked arm (RequestContext.rs:3167-3179), routing consumed-ReadableStream response bodies to the same ERR_BODY_ALREADY_USED error handler that already fires for Body::Value::Used (string/Blob/Uint8Array bodies, added in #33118). The test file gains an it.each matrix over five body kinds plus a partial-read case.

Security risks

None. This tightens behavior — a case that previously silently served an empty/truncated 200 now surfaces as a 500 via the user's error handler. No new input parsing, no auth/crypto, no untrusted-data handling.

Level of scrutiny

Low-to-medium. The change is 14 lines of Rust that mirror two adjacent sibling patterns exactly: the error object and run_error_handler call are copied from the Body::Value::Used arm at line 3122, and the .deinit() cleanup matches the Source::Invalid branch at line 3202. ReadableStream__isDisturbed (WebStreamsExports.cpp:115) is a dynamicDowncast + bool field read — it cannot throw or run user JS, so no exception-scope or re-entrancy concerns. The is_aborted_or_ended() guard at the top of the Locked arm (line 3145) already covers this path, matching the existing is_locked() branch which also doesn't re-check.

Other factors

• The new check is placed before the existing is_locked() check, which is correct ordering: a fully-consumed stream is disturbed but not locked, and BODY_ALREADY_USED is the more specific/helpful error.
• Tests are in the right file, use port: 0 / await using, assert exact {code, name, message}, and the PR description confirms they fail on system bun and pass on the debug build.
• The partial-read test explicitly guards against the old "serve the unread remainder" behavior with a comment and exact-body assertion.
• No prior reviewer comments to address; only a robobun status note in the timeline.