Cron jobs have execution-time limits

A cron job without an execution time limit can run for the full platform timeout — 5 minutes on Vercel Hobby, 15 minutes on Pro — and if it hangs due to an upstream dependency or a slow database query, it will consume compute on every scheduled tick without making progress. CWE-770 applies: resources are consumed without any application-level limit. For hourly crons, this means up to 24 hung invocations per day, each burning the full platform budget. On multi-tenant serverless infrastructure, a stuck cron competes for concurrency with user-facing requests. A maxDuration export is the zero-cost fix — it adds a hard ceiling with no code change to the business logic.

Export maxDuration from every Vercel cron handler and wrap the job body in an AbortController for libraries that support it. Both controls give you defense in depth.

// app/api/cron/sync/route.ts
export const maxDuration = 60  // hard 60-second limit on Vercel
export const dynamic = 'force-dynamic'

export async function GET(req: Request) {
  const controller = new AbortController()
  const timeout = setTimeout(() => controller.abort(), 55_000)  // abort 5s before maxDuration
  try {
    await runSyncJob({ signal: controller.signal })
    return Response.json({ ok: true })
  } finally {
    clearTimeout(timeout)
  }
}

Set maxDuration to the minimum time your job legitimately needs, not the platform maximum. Crons that routinely approach their time limit are a signal to break the job into smaller chunks.