Suspected Node.js subprocess leak in v2.1.160 — ~115 node processes exhaust RAM, trigger system-wide OOM

Environment

• Claude Code: 2.1.160
• OS: Pop!_OS (COSMIC desktop), 32 GB RAM
• Node (nvm): v24.12.0
• Usage: claude run inside tmux

What happened

During a session, a swarm of ~115 Node.js processes accumulated and exhausted all 32 GB of RAM over ~8 minutes, triggering a kernel OOM cascade that killed session-critical services and forced a reboot.

Evidence (from kernel logs)

• First process to invoke the OOM killer was V8Worker (a V8/Node engine thread).
• 115 distinct processes named MainThread (Node worker_threads main-thread comm name) present in the crash window, spawned in contiguous PID bursts, each ~300–400 MB RSS — matching the footprint of a Claude Code process.
• These were not MCP servers (all remote HTTP/SSE connectors, no local stdio spawns) and not unrelated tooling (verified separately — e.g. local nvim Python plugins were a separate, small python3 group).

Impact

With no early-OOM daemon active (systemd-oomd and earlyoom both inactive), the kernel global OOM killer reaped pipewire / wireplumber / pipewire-pulse / dbus-broker / the session systemd rather than the node swarm → audio loss, desktop unresponsive (COSMIC app launcher / workspaces), forced reboot.

Caveat

I could not capture the parent process live (the swarm had already exited by the time I investigated), so I cannot prove Claude Code spawned these processes — but the V8/Node signature, the per-process size match, and the correlation with Claude Code usage strongly suggest it.

Repro / next steps

Not yet reproduced on demand. If it recurs, the most useful capture is the live parent:

ps -eo pid,ppid,rss,comm,args --sort=-rss | grep -iE 'MainThread|node'

The ppid would confirm the spawner.

Possibly relevant: anything in 2.1.x touching subagents / background Bash tasks / subprocess lifecycle.