Request body size limits configured

Accepting unbounded request bodies maps to CWE-770 (unrestricted resource allocation) and CWE-20 (improper input validation), and is flagged under OWASP API 2023 as unrestricted resource consumption. A single POST request carrying a multi-gigabyte JSON body can exhaust serverless function memory and cause a cold-start cascade, effectively a one-request denial of service. On platforms like Vercel, the 4.5MB default limit is generous enough to permit several hundred kilobytes of JSON per field — far more than typical API payloads need.

Set explicit body size limits in route handlers or middleware appropriate to what each endpoint actually needs. For Next.js Pages Router, add per-route config:

export const config = {
  api: { bodyParser: { sizeLimit: '1mb' } },
}

For Next.js App Router, enforce the limit in src/middleware.ts via the Content-Length header, or at the platform level in vercel.json:

{
  "functions": {
    "app/api/**": { "maxDuration": 30 }
  }
}

For Express: app.use(express.json({ limit: '1mb' })). Non-file-upload API endpoints rarely need more than 1MB; file upload endpoints should use streaming to object storage rather than buffering the entire body in memory.