Request body size limits

“Express has no request size limit” is a common claim and it is wrong. body-parser — which Express has bundled since 4.16, so express.json() is body-parser — documents a default limit of 100kb on every parser it exposes.

So this page is a verify, not a configure. The finding is almost never a missing limit; it is a limit someone raised.

the fix

// The defaults are already 100kb. State them if you want them visible,
// and set a deliberate value where you genuinely need more.
app.use(express.json({ limit: "100kb" }));
app.use(express.urlencoded({ extended: false, limit: "100kb" }));

verify it workedRun this in: shell

grep -rn "limit:" --include=*.js --include=*.ts src/ | grep -iE "mb|[0-9]{4,}kb"

That is the check worth running: not “is there a limit” but “did someone set a large one”. limit: "50mb" typically enters a codebase to make one file upload work and then applies to every JSON endpoint in the application forever.

Why the raised limit matters more than the default

express.json() buffers the body in memory and then parses it. At 100kb that is nothing. At 50mb, a handful of concurrent requests is measured in gigabytes, and the process does not need to be attacked deliberately to fall over.

If you need large uploads, they should not go through the JSON parser at all — stream them, or handle them with a multipart library that writes to disk, and leave the JSON limit alone.

Note extended: false above. The extended parser uses qs and produces nested objects from query-string syntax; the simple one does not. Express 5 made the same move for query strings, defaulting query parser to 'simple' (read from lib/application.js), which narrows the surface for parameter-pollution and prototype-pollution style inputs. Match that in your body parser unless you know you need nesting.

before you ship this

Lowering a limit that was raised for a reason breaks whatever needed it, usually a file upload or a bulk import, and usually with a 413 that the front end reports as a generic failure.

Find what needed the headroom before you tighten it, and give that one route its own parser instead of the whole application.

Related

• Rate limiting — the other resource-exhaustion control
• A request-size limit at the proxy rejects an oversized body before Node ever allocates for it. Worth setting there as well; it costs the application nothing.