File upload handlers enforce a maximum file size

A file upload handler without a size limit is a direct path to disk exhaustion and runaway cloud storage costs — a single malicious actor can POST a 50 GB file to your server, filling disk and triggering overage charges before any alert fires. This maps to CWE-770 and OWASP A05:2021 (Security Misconfiguration): the absence of a limit is a misconfiguration at the application layer, independent of what a CDN or load balancer might reject. Platforms like Vercel enforce a 4.5 MB body limit by default, but self-hosted or Docker deployments carry no such protection. A successful attack disrupts all users on the same host, not just the attacker.

Set maxFileSize at library initialization, not as a post-read check. Validating size after reading defeats the purpose — the damage is done once the bytes hit memory.

import formidable from 'formidable'

export async function POST(req: Request) {
  const form = formidable({
    maxFileSize: 10 * 1024 * 1024,  // 10 MB hard cap
    maxFiles: 1,
  })
  // formidable will throw a 413 automatically if the limit is exceeded
  const [, files] = await form.parse(req as any)
  // ...
}

For Next.js Route Handlers using request.formData(), check file.size immediately: if (file.size > 10 * 1024 * 1024) return Response.json({ error: 'File too large' }, { status: 413 }).