fix(server): reduce express.json body limit from 50 mb to 512 kb [NSoC'26]#142
Open
anshul23102 wants to merge 1 commit into
Open
fix(server): reduce express.json body limit from 50 mb to 512 kb [NSoC'26]#142anshul23102 wants to merge 1 commit into
anshul23102 wants to merge 1 commit into
Conversation
…C'26] A 50 MB body limit allowed a single HTTP request to force the server to allocate and parse 50 MB of JSON before any route handler ran. Combined with the existing 100 req / 15 min rate limit, an attacker could push up to 5 GB of data per IP per window, exhausting server heap memory. Legitimate payloads for this API (task objects, chat messages, analytics) are at most a few kilobytes. 512 KB is more than sufficient for any real request and eliminates the memory-exhaustion vector. Closes Shriii19#137
|
@anshul23102 is attempting to deploy a commit to the shreemp194-gmailcom's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
👋 Thank you for opening this pull request! I will review your changes and assist you soon. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The Express body parser was configured with a 50 MB limit. Legitimate payloads for this API (task objects, chat messages) are at most a few kilobytes. The oversized limit allowed a single request to force the server to allocate and parse 50 MB of JSON before any route handler ran. Combined with the existing rate limiter (100 req / 15 min per IP), an attacker could push up to 5 GB of data per window.
Related Issue
Closes #137
Type of Change
Root Cause
The
limit: "50mb"value was set on bothexpress.json()andexpress.urlencoded(). No legitimate request in the application requires more than a few kilobytes.Changes Made
backend/server.jsexpress.json({ limit: "50mb" })toexpress.json({ limit: "512kb" })backend/server.jsexpress.urlencoded({ limit: "50mb", ... })toexpress.urlencoded({ limit: "512kb", ... })Screenshots or Demo
Not applicable (backend-only change).
Testing Done
Checklist
NSoC Label Request
@Shriii19 could you please add the appropriate NSoC '26 label to this PR? Thank you!