Summary
express.json() is called without a limit option, accepting arbitrarily large JSON payloads. An attacker can send multi-gigabyte payloads to exhaust server memory.
Details
- File: �pps/public-api/src/app.js
- �pp.use(express.json()) — no limit parameter
- Default is 100KB in Express, but without explicit limit it may be misconfigured
Impact
An attacker can easily exhaust server memory by sending large JSON payloads, causing a denial of service.
Suggested Fix
Set an explicit limit: �pp.use(express.json({ limit: '1mb' })).
Summary
express.json() is called without a limit option, accepting arbitrarily large JSON payloads. An attacker can send multi-gigabyte payloads to exhaust server memory.
Details
Impact
An attacker can easily exhaust server memory by sending large JSON payloads, causing a denial of service.
Suggested Fix
Set an explicit limit: �pp.use(express.json({ limit: '1mb' })).