Description
The contact API intends to reject payloads larger than 100KB, but it only checks the optional Content-Length header before calling request.json(). When a request is sent with chunked transfer and no Content-Length, the full body is parsed before validation, including unused fields that are not needed by the contact form.
Steps to Reproduce
- Start the landing app locally.
- Send an oversized JSON POST to
/api/contact with Content-Length; observe it returns 413.
- Send the same oversized JSON body using chunked transfer without
Content-Length.
- Observe that the route parses the body and proceeds past the intended 100KB limit.
Expected Behaviour
The API should enforce the 100KB request limit regardless of whether Content-Length is present, before parsing the full JSON body.
Actual Behaviour
The API only rejects oversized requests when Content-Length is present. Chunked requests without that header can be parsed fully before field validation runs.
Environment
- OS: Windows
- Browser / Node version: Node v22.17.0, Next.js 16.2.6
- Repo version / commit: v2.2.0 / dbaae83
Description
The contact API intends to reject payloads larger than 100KB, but it only checks the optional
Content-Lengthheader before callingrequest.json(). When a request is sent with chunked transfer and noContent-Length, the full body is parsed before validation, including unused fields that are not needed by the contact form.Steps to Reproduce
/api/contactwithContent-Length; observe it returns413.Content-Length.Expected Behaviour
The API should enforce the 100KB request limit regardless of whether
Content-Lengthis present, before parsing the full JSON body.Actual Behaviour
The API only rejects oversized requests when
Content-Lengthis present. Chunked requests without that header can be parsed fully before field validation runs.Environment