[SECURITY] No request size limiting on API endpoints - DoS vulnerability

[Siddh2024]

Description

The API endpoints do not limit incoming request body sizes. An attacker can send extremely large payloads to exhaust server memory and CPU, causing a denial of service.

Suggested Fix

Implement request body size limits using middleware (e.g., body-parser limit option or nginx client_max_body_size).

[aavishkarchaudhari]

Hi @Siddh2024,

I would like to work on this issue under GSSoC'26. I plan to implement request body size limits on the API endpoints to mitigate potential DoS attacks caused by excessively large payloads.

Could you please assign this issue to me?

Thank you!

[avadhesh11]

Hi @Siddh2024, @yash-pouranik! I'd like to work on this issue if it's still available. While implementing the fix, is there a preferred request body size limit (for example, 1 MB or 10 MB), or should I use a reasonable default? Thank you!

[Ayush4958]

hi @Siddh2024 ,
can you mention those API endpoint which have no limitation ??

[yash-pouranik]

I feel most of the APIS doesnt check the payload size?
@Ayush4958
@Siddh2024
@avadhesh11
@aavishkarchaudhari

Who ever wanna work?
but please before working. u have to share the scope of the issue and all the endpoints that will effect including middleware.

[Ayush4958]

@yash-pouranik , I think @Siddh2024 had raised this issue so he's a suitable fit for it but before that
he should make it very concise issue and also mention end point location and In PR body he should also mention
what is expected payload for different endpoint and also the reason for the limiting the request body size

[Ayush4958]

@Siddh2024 , some things to notice

If you are planning to create the middleware for limiting the body size make it dynamic so its usable for most of cases
and also for the other API endpoint
and to decide the limitation for request body size, research on it what size of data is standard it can receive it by user
and also mention the reasoning in PR for limiting the request body size

[anshul23102]

Hi! This issue appears to be unassigned. Would it be possible to assign it to me for GSSoC '26? I'm interested in working on this and would be happy to submit a PR once assigned.

Thank you!

[yash-pouranik]

@Siddh2024
?? can u do this?

[aaniya22]

pls assign this to me under gssoc

[Ayush4958]

@aaniya22
Select and mention the api u want to set limit

[aaniya22]

@aaniya22
Select and mention the api u want to set limit

yeah so i was thinking of just adding a global limit first using express.json({ limit: '1mb' }) and express.urlencoded({ limit: '1mb', extended: true }) in the main app file, that way it covers all endpoints by default. if any specific route needs a diff limit (like file uploads) i'll handle that separately. will raise a pr once assigned

[Ayush4958]

Sounds good
Let's hear from @yash-pouranik
So he could assign u

[yash-pouranik]

I think 500KB is enough for all the users. And for file uploads, we use pre signed urls bsclly none of our apis work for file uploads. Storage provider handles the uploads via pre signed URLs. So we can have a global size limitter on all the api with 500KB.

@aaniya22

what say @Ayush4958

[yash-pouranik]

@aaniya22