AIKIDO-2026-687335

TL;DR

The WebSocket permessage-deflate size-limit cleanup removes every listener from the internal zlib inflate stream, including its error listener, while that stream can still emit. A compressed message that crosses the decompressed-payload limit and then contains a malformed DEFLATE byte emits a zlib data error with no listener, which Node.js treats as fatal and terminates the process. Application WebSocket error handlers cannot catch it because the failing object is the internal inflater. The fix keeps an error listener attached during size-limit cleanup.