Max message payload size enforced server-side; oversized frames rejected with error

Without a server-side payload cap, any client can send multi-megabyte WebSocket frames. Processing an oversized frame allocates that memory per connection, and if multiple clients do this simultaneously, the server runs out of heap before the OS-level connection limit is reached. CWE-770 (Allocation of Resources Without Limits) and CWE-400 (Uncontrolled Resource Consumption) both apply. This is a trivial denial-of-service vector in community platforms where registration is open and any user can author a message.

Enforce a payload size limit in the message handler before any processing occurs. Reject oversized frames with an error response and do not process their contents.

const MAX_PAYLOAD = 65_536; // 64 KB

socket.on('send_message', (data: unknown) => {
  const size = Buffer.byteLength(JSON.stringify(data));
  if (size > MAX_PAYLOAD) {
    socket.emit('error', { code: 413, message: `Payload too large: ${size} > ${MAX_PAYLOAD}` });
    return;
  }
  // proceed
});

Socket.IO also exposes a maxHttpBufferSize server option that enforces this at the transport layer — set it in the Server constructor as a belt-and-suspenders complement to the per-handler check.