quic.SessionOptions.streamIdleTimeout

The maximum time in milliseconds that a peer-initiated stream can be idle (no data received) before it is automatically destroyed. This protects against slowloris-style attacks where a remote peer opens streams but never sends data, holding server resources indefinitely. Only peer-initiated streams are checked — locally-initiated streams are the application's responsibility. Set to 0 to disable.

The idle check runs as part of the normal send processing loop, so it adds no additional timers or event loop overhead. The session.stats.streamsIdleTimedOut counter tracks how many streams have been destroyed by this mechanism.