Request body size limits enforced

Unbounded request bodies are a denial-of-service vector that requires no authentication and minimal sophistication. OWASP API Security Top 10 2023 API4 (Unrestricted Resource Consumption) and CWE-770 (Allocation of Resources Without Limits) both flag missing body size limits as a resource exhaustion risk. Sending a 1 GB JSON payload to an endpoint that reads the full body before rejecting it consumes memory, CPU, and I/O on every request — a single attacker can saturate a server. Node.js HTTP servers buffer the request body before passing it to handlers; without a size limit, that buffer is attacker-controlled. Cloud functions with per-invocation memory limits are particularly vulnerable.

Set body size limits in your HTTP framework's parser configuration. In Next.js App Router, override per-route via route segment config; in Express, pass limit to express.json().

// Next.js App Router — src/app/api/upload/route.ts
export const config = {
  api: { bodyParser: { sizeLimit: '10mb' } }  // override for large-upload routes
}

// Default limit for all other routes — next.config.js
module.exports = {
  experimental: {
    serverActions: { bodySizeLimit: '1mb' }  // sensible default
  }
}

// Express
app.use(express.json({ limit: '1mb' }))
app.use(express.urlencoded({ extended: true, limit: '1mb' }))

Set the default at 1 MB and raise it only for specific routes that legitimately handle larger payloads (file uploads, bulk imports).