@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/node';
+import { loggingTransport } from '@sentry-internal/node-integration-tests';
+
+Sentry.init({
+  dsn: 'https://public@dsn.ingest.sentry.io/1337',
+  release: '1.0',
+  tracesSampleRate: 1.0,
+  transport: loggingTransport,
+});
@@ -0,0 +1,29 @@
+import express from 'express';
+import { startExpressServerAndSendPortToRunner } from '@sentry-internal/node-integration-tests';
+
+const MIDDLEWARE_COUNT = 12;
+
+const app = express();
+
+// More synchronous middleware than Node's default of 10 listeners per event, so
+// layer spans that stayed open until `next()` returned would pile up a response
+// `finish` listener per layer.
+for (let i = 0; i < MIDDLEWARE_COUNT; i++) {
+  app.use(function syncMiddleware(_req, _res, next) {
+    next();
+  });
+}
+
+app.get('/test/express', (_req, res) => {
+  const finishListeners = res.listenerCount('finish');
+
+  // Without the fix, this work is included in every preceding middleware's span.
+  const until = Date.now() + 50;
+  while (Date.now() < until) {
+    // busy-wait
+  }
+
+  res.send({ finishListeners });
+});
+
+startExpressServerAndSendPortToRunner(app);
@@ -0,0 +1,48 @@
+import { EventEmitter } from 'node:events';
+import { afterAll, describe, expect } from 'vitest';
+import { cleanupChildProcesses, createEsmAndCjsTests } from '../../../utils/runner';
+
+const MIDDLEWARE_COUNT = 12;
+
+describe('express layer span end', () => {
+  afterAll(() => {
+    cleanupChildProcesses();
+  });
+
+  createEsmAndCjsTests(__dirname, 'scenario.mjs', 'instrument.mjs', (createRunner, test) => {
+    test('ends each middleware span when it calls `next`, before the route handler runs', async () => {
+      const runner = createRunner()
+        .unordered()
+        .expect({
+          span: container => {
+            const middlewareSpans = container.items.filter(
+              item => item.attributes['express.type']?.value === 'middleware',
+            );
+            const handlerSpan = container.items.find(
+              item => item.attributes['express.type']?.value === 'request_handler',
+            );
+
+            // Express 4 also runs its built-in `query` and `expressInit` middleware.
+            expect(middlewareSpans.filter(span => span.name === 'syncMiddleware')).toHaveLength(MIDDLEWARE_COUNT);
+            expect(handlerSpan).toBeDefined();
+
+            for (const middlewareSpan of middlewareSpans) {
+              expect(middlewareSpan.end_timestamp).toBeLessThanOrEqual(handlerSpan!.start_timestamp);
+            }
+          },
+        })
+        .start();
+
+      runner.makeRequest('get', '/test/express');
+      await runner.completed();
+    });
+
+    test('does not accumulate a response `finish` listener per layer', async () => {
+      const runner = createRunner().start();
+
+      const response = await runner.makeRequest<{ finishListeners: number }>('get', '/test/express');
+
+      expect(response?.finishListeners).toBeLessThan(EventEmitter.defaultMaxListeners);
+    });
+  });
+});
@@ -94,17 +94,21 @@ export function instrumentExpress(
       },
     });
 
-    // Pop the layer path when the layer hands off via `next`. `asyncStart` fires
-    // when `next` is called and *before* the downstream layer runs, so the
-    // per-request path chain reflects only the current chain when each layer
-    // reconstructs its route. The `error` event captures throws at the layer
-    // level (see `captureLayerError`), before any user error-handling middleware.
+    // Pop the layer path and end the layer span when the layer hands off via
+    // `next`. `asyncStart` fires when `next` is called and *before* the
+    // downstream layer runs, so the per-request path chain reflects only the
+    // current chain when each layer reconstructs its route, and each span covers
+    // only its own layer. The `error` event captures throws at the layer level
+    // (see `captureLayerError`), before any user error-handling middleware.
     channel.subscribe({
       start: NOOP,
       asyncEnd: NOOP,
       end: NOOP,
       error: data => captureLayerError(data, options.shouldHandleError),
-      asyncStart: popLayerPathForLayer,
+      asyncStart: data => {
+        popLayerPathForLayer(data);
+        endLayerSpanOnNext(data);
+      },
     });
   }
 }
@@ -202,6 +206,25 @@ function popLayerPathForLayer(data: HandleChannelContext): void {
   }
 }
 
+/**
+ * End a layer's span once it hands control onward via `next`.
+ *
+ * The tracing-channel helper would otherwise end it on `asyncEnd`, which only
+ * fires once `next` *returns*. Express runs the rest of the chain synchronously
+ * inside `next`, so that would keep every layer on the synchronous chain open
+ * (each holding a response `finish` listener) until the whole chain unwinds,
+ * and inflate each span with the downstream layers' synchronous work. The
+ * helper's later `asyncEnd` is then a no-op, since `span.end()` is idempotent.
+ */
+function endLayerSpanOnNext(data: HandleChannelContext): void {
+  const span = data._sentrySpan;
+  if (!span) {
+    return;
+  }
+  data._sentryCleanup?.();
+  span.end();
+}
+
 /**
  * Open a span for one layer invocation. Returns `undefined` to opt the layer
  * out (error handlers, or a layer with no active parent trace) — the helper
@@ -326,9 +349,9 @@ function getSpanForLayer(data: HandleChannelContext, options: ExpressIntegration
   });
 
   // A layer that sends the response (route handlers, typically) never calls
-  // `next`, so the channel's `asyncEnd` never fires. End on the response's
-  // `finish` in that case. When `next` *is* called, the helper ends the span
-  // (via `asyncEnd`) and `beforeSpanEnd` removes this now-redundant listener.
+  // `next`, so the channel's `asyncStart` never fires. End on the response's
+  // `finish` in that case. When `next` *is* called, `endLayerSpanOnNext` ends
+  // the span and removes this now-redundant listener.
   if (res && typeof res.once === 'function') {
     const onFinish = (): void => {
       span.end();