External API calls inside loops are batched or rate-paced

Sequential await calls inside a loop over user-supplied data are simultaneously a latency bomb and a cost bomb: 100 items × 200ms each = 20 seconds of wall time, and each iteration holds an HTTP connection open. When the input array is user-controlled with no length cap — for example req.body.urls.forEach(url => fetch(url)) — the number of outbound requests is directly attacker-controlled. CWE-770 applies: an unbounded array fed into a loop of external calls gives an attacker leverage over your third-party API rate limits, egress costs, and server-side connection count. Even internal N+1 patterns inflate database query counts and slow down all concurrent users.

Replace sequential await-in-loop patterns with bounded concurrency using p-map. Combine with a schema-level array length cap to prevent the input from growing arbitrarily.

import { z } from 'zod'
import pMap from 'p-map'

const ScrapeSchema = z.object({
  urls: z.array(z.string().url()).max(50),
})

export async function POST(req: Request) {
  const { urls } = ScrapeSchema.parse(await req.json())
  const results = await pMap(
    urls,
    async (url) => {
      const res = await fetch(url, { signal: AbortSignal.timeout(5000) })
      return res.text()
    },
    { concurrency: 5 },
  )
  return Response.json({ results })
}

The concurrency cap of 5 prevents saturating your outbound connection pool regardless of input size.