Retry limit set with dead letter escalation

An unbounded retry limit — or no limit at all — allows a job to cycle indefinitely, consuming worker capacity and queue resources without ever resolving. CWE-770 covers allocation of resources without limits; an infinite retry loop is a resource exhaustion vector against the queue infrastructure itself. CWE-391 covers insufficient logging of errors — a job that fails silently after an unbounded retry chain leaves no trace for operators. ISO-25010:2011 reliability.recoverability requires that failed states are detectable and recoverable; an undocumented failure is neither.

Set an explicit attempts limit between 3 and 10 on the BullMQ queue, keep failed jobs, and fire an alert when the limit is reached:

export const emailQueue = new Queue('email', {
  connection,
  defaultJobOptions: {
    attempts: 5,
    backoff: { type: 'exponential', delay: 2000 },
    removeOnFail: false
  }
})

worker.on('failed', async (job, err) => {
  if (job && job.attemptsMade >= (job.opts.attempts ?? 5)) {
    logger.error({ jobId: job.id, data: job.data }, 'Job exhausted retries')
    await alertOps(`Email job ${job.id} permanently failed: ${err.message}`)
  }
})

Never set attempts: Infinity or omit the attempts field — both produce equivalent unbounded behavior.