PDF generation has page count limits

PDF generation is CPU-bound: a renderer like Puppeteer or @react-pdf/renderer that loops through a user-supplied items array with no length cap is a free compute gift to any attacker. A POST with items: Array(100000).fill({}) can saturate a server core for minutes, blocking all other requests on that worker. CWE-400 (Uncontrolled Resource Consumption) applies directly: the cost of the operation scales linearly with user input. This is especially acute on serverless platforms where function duration directly maps to billing — one malformed invoice request can burn through your monthly Vercel function budget.

Validate the items array length at schema parse time, before the PDF renderer is invoked. Place the limit in src/lib/invoice.ts or wherever the Zod schema lives.

import { z } from 'zod'

const InvoiceSchema = z.object({
  items: z.array(
    z.object({ name: z.string().max(100), price: z.number().min(0) })
  ).min(1).max(100),
})

export async function POST(req: Request) {
  const { items } = InvoiceSchema.parse(await req.json())
  // items is guaranteed ≤ 100 entries here
  const pdf = await generateInvoicePdf(items)
  return new Response(pdf, { headers: { 'Content-Type': 'application/pdf' } })
}

Return HTTP 422 (Unprocessable Entity) for schema violations so callers get a meaningful error rather than a timeout.