Image processing has output dimension limits

Image processing libraries like Sharp allocate memory proportional to output pixel area — a request for a 999,999 × 999,999 image allocates roughly 3 TB of virtual memory, which OOMs the Node process instantly. This is CWE-770 and CWE-400 in the same request: resource exhaustion via unconstrained user input. Any endpoint that accepts width and height from a query string or POST body without validation is a denial-of-service vector with zero authentication required. OWASP A05:2021 (Security Misconfiguration) covers this class of missing input constraint. Even modest abuse — thousands of 4000×4000 requests — can exhaust CPU and inflate cloud egress for legitimate users.

Validate width and height against a Zod schema with a hard .max() before any Sharp call. Reject the request before the buffer is even allocated.

import { z } from 'zod'
import sharp from 'sharp'

const ResizeSchema = z.object({
  width: z.number().int().min(1).max(2000),
  height: z.number().int().min(1).max(2000),
})

export async function POST(req: Request) {
  const { width, height } = ResizeSchema.parse(await req.json())
  const buffer = await req.arrayBuffer()
  const output = await sharp(Buffer.from(buffer))
    .resize(width, height)
    .webp({ quality: 80 })
    .toBuffer()
  return new Response(output, { headers: { 'Content-Type': 'image/webp' } })
}

Choose a sensible max for your product — 2000px is generous for thumbnails, 4000px for user-uploaded cover images.