HIGH: No explicit JSON body size limit on express.json() - default 100KB #74

New Issue

Closed

opened 2026-05-31 12:03:21 -05:00 by null · 1 comment

null commented

2026-05-31 12:03:21 -05:00

Owner

Bug Description

server.js:32 uses app.use(express.json()) without an explicit limit option, defaulting to Expresss 100KB body size limit. While import routes override this (2MB, 10MB), all other routes are capped at 100KB.

This could cause cryptic 413 Payload Too Large errors for legitimate admin operations with extensive data, or any future endpoint that accepts larger payloads.

Affected Files

server.js:32

Impact

Unexpected 413 errors on legitimate large payloads with unclear error messages.

Recommended Fix

Set an explicit limit: app.use(express.json({ limit: 1mb })) or similar, matching the applications expected payload sizes.

## Bug Description server.js:32 uses app.use(express.json()) without an explicit limit option, defaulting to Expresss 100KB body size limit. While import routes override this (2MB, 10MB), all other routes are capped at 100KB. This could cause cryptic 413 Payload Too Large errors for legitimate admin operations with extensive data, or any future endpoint that accepts larger payloads. ## Affected Files - server.js:32 ## Impact Unexpected 413 errors on legitimate large payloads with unclear error messages. ## Recommended Fix Set an explicit limit: app.use(express.json({ limit: 1mb })) or similar, matching the applications expected payload sizes.