# Request body size limits configured

- **Pattern:** `ab-002199` (`saas-api-design.request-response.request-size-limits`)
- **Severity:** medium
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-002199
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-002199)

## Why it matters

Accepting unbounded request bodies maps to CWE-770 (unrestricted resource allocation) and CWE-20 (improper input validation), and is flagged under OWASP API 2023 as unrestricted resource consumption. A single POST request carrying a multi-gigabyte JSON body can exhaust serverless function memory and cause a cold-start cascade, effectively a one-request denial of service. On platforms like Vercel, the 4.5MB default limit is generous enough to permit several hundred kilobytes of JSON per field — far more than typical API payloads need.

## Severity rationale

Medium because a missing size limit enables memory exhaustion via oversized request bodies, potentially taking down serverless functions for all concurrent users.

## Remediation

Set explicit body size limits in route handlers or middleware appropriate to what each endpoint actually needs. For Next.js Pages Router, add per-route config:

```ts
export const config = {
  api: { bodyParser: { sizeLimit: '1mb' } },
}
```

For Next.js App Router, enforce the limit in `src/middleware.ts` via the `Content-Length` header, or at the platform level in `vercel.json`:

```json
{
  "functions": {
    "app/api/**": { "maxDuration": 30 }
  }
}
```

For Express: `app.use(express.json({ limit: '1mb' }))`. Non-file-upload API endpoints rarely need more than 1MB; file upload endpoints should use streaming to object storage rather than buffering the entire body in memory.

## Detection

- **ID:** `request-size-limits`
- **Severity:** `medium`
- **What to look for:** Count all POST/PUT/PATCH routes. Check whether the application enforces a request body size limit for API routes. Look for: Next.js `export const config = { api: { bodyParser: { sizeLimit: '...' } } }` in Pages Router handlers; Next.js App Router custom `bodyParser` or platform-level config; Express `express.json({ limit: '...' })` or `express.urlencoded({ limit: '...' })`; Fastify `bodyLimit` option; Hono body size middleware; Vercel's default 4.5MB body limit (check if overridden). A missing explicit limit means the framework default applies (which may be too large or too small depending on the use case).
- **Pass criteria:** An explicit request body size limit of no more than 10MB is configured at the framework, middleware, or platform level. The limit is appropriate for the endpoint's use case (API endpoints: 1MB-10MB is typical; non-file-upload endpoints: 1MB or less).
- **Fail criteria:** No explicit size limit is configured anywhere for API routes (relying solely on implicit defaults), AND the application accepts large bodies or has upload endpoints without any guardrails.
- **Skip (N/A) when:** Skip when no POST, PUT, or PATCH routes that read the request body exist. Specifically, look for routes that call `.json()`, `.text()`, `.formData()`, or `.arrayBuffer()` on the request object. POST routes that never parse the request body (e.g., routes that use only session/cookie data or URL parameters) do not need body size limits and should be excluded from this check's evaluation.
- **Detail on fail:** Example: `No bodyParser size limit configured`. Note where the limit is missing (e.g., "No bodyParser size limit found in Next.js Pages Router API config; no platform-level limit in vercel.json"). Max 500 chars.
- **Remediation:** Set explicit body size limits in `app/api/` or `pages/api/` route handlers appropriate to your use case. For Next.js Pages Router, add to each route that needs a non-default limit: `export const config = { api: { bodyParser: { sizeLimit: '1mb' } } }`. For Next.js App Router, configure via middleware or handle via streaming. For Express: `app.use(express.json({ limit: '1mb' }))`. For Vercel, the default is 4.5MB per request — document this and add explicit in-code limits for sensitive endpoints. Do not accept unbounded request bodies on endpoints that don't need them; this leaves you open to memory exhaustion attacks.

## External references

- cwe CWE-770
- cwe CWE-20
- owasp A05

Taxons: cost-efficiency, injection-and-input-trust

HTML version: https://auditbuffet.com/patterns/ab-002199