[sboettch]

Refs: https://github.com/nodejs/node/blob/main/doc/api/zlib.md

Hello nodejs/node documentation maintainers, and thank you for maintaining the node:zlib API reference across gzip, brotli, and zstd. I am a citizen applied data scientist working on WebHealth (an open public-interest security observatory), and while testing streaming decompression configurations locally across Node.js runtimes, I noticed a small point in doc/api/zlib.md where clarifying how maxOutputLength interacts with streaming decompressors could help callers bound memory safely.

doc/api/zlib.md documents maxOutputLength under Class: Options, Class: BrotliOptions, and Class: ZstdOptions for single-buffer convenience methods (zlib.gunzip(), zlib.brotliDecompress(), zlib.zstdDecompress(), and their *Sync counterparts). On Node.js v22.x, v24.x, and v26.5.0, passing { maxOutputLength } to streaming factories (zlib.createGunzip(), zlib.createBrotliDecompress(), zlib.createZstdDecompress()) bounds per-chunk internal buffer growth rather than cumulative decoded stream output across chunks (RFC 1952 / RFC 7932 / RFC 8878, CWE-409).

Clarify in doc/api/zlib.md (Class: Options, Class: BrotliOptions, and Class: ZstdOptions) that maxOutputLength caps total output on convenience methods rather than cumulative stream output across create*Decompress() streams, and document a node:stream/promises pipeline() + Transform byte-counter pattern that aborts streaming decompression and destroys the upstream Readable as soon as a cumulative byte limit is exceeded.

Validation:

• Verified doc/api/zlib.md line wrapping (<= 80 columns), reference links ([convenience methods][], [pipeline()][], [stream.Transform][]), and whitespace (git diff --check) with zero warnings.
• Verified the documented pipeline() + Transform guard across createGunzip(), createBrotliDecompress(), and createZstdDecompress() at exact 65,536 B (OK) and 65,537 B (RangeError + source.destroyed === true).

Thank you very much for your time and review. If a shorter inline note under maxOutputLength or a different location in doc/api/zlib.md fits the documentation style better, I am happy to adjust this however you prefer.

Warm regards,
Sophia Boettcher

[github-actions]

Welcome to Node.js, and thank you for your first contribution!

Before review, please take a moment to read:

• the guide for first-time contributors
• the contribution and automation policies
• the pull request guide
• the AI use policy
• the Code of Conduct

Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal.