`bodyLimit()` keeps every transfer chunk of a request body in memory, allowing memory exhaustion with tiny chunks

Summary

Since 4.12.16, bodyLimit() reads the whole request body before the handler runs so that the limit also applies to chunked requests. It kept every chunk delivered by the runtime as a separate array and later replayed them. A client that sends the body in very small transfer chunks makes the middleware retain millions of small arrays for a body that is within the configured limit. The memory used is many times the body size, and the process can be terminated before the handler runs.

Details

The size check counted the payload bytes correctly, so the configured maxSize was respected. The problem is the per-chunk overhead: each Uint8Array the runtime delivers was kept as its own object until the body was complete, then enqueued again into a new stream. With one-byte HTTP transfer chunks, a 10 MiB upload becomes about ten million retained objects.

bodyLimit() now copies the incoming chunks into one buffer that grows up to maxSize, and forwards that buffer as the request body. Memory use is bounded by the configured limit regardless of how the body is chunked.

Observed on Bun and Node.js, where the HTTP parser delivers transfer chunks as they arrive.

Impact

An unauthenticated client can exhaust the memory of a server that uses bodyLimit() with a single request that stays within the configured limit, terminating the process.