require-express-body-parser-limits

Require size limits on body parser middleware to prevent DoS attacks

Severity: 🟡 Warning
CWE: CWE-400

Error Message Format

The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:

🔒 CWE-400 OWASP:A06 CVSS:7.5 | Uncontrolled Resource Consumption (ReDoS) detected | HIGH
   Fix: Review and apply the recommended fix | https://owasp.org/Top10/A06_2021/

Message Components

Rule Details

This rule detects an Express/body-parser body parser configured with an explicit size limit larger than the app can afford.

What it does not report

express.json() with no options is not unbounded. All four parsers — json, urlencoded, raw, text — ship limit: '100kb' as their documented default in Express 4 and 5 alike, so omitting the option leaves the parser at 100kb, far below every threshold this rule enforces. Reporting the omission was a claim about a default that does not exist; it was removed on 2026-08-12, and the missingLimit message with it.

The limit is read in bytes, so both spellings are compared the same way: limit: '50mb' and limit: 52428800 are the same finding. The numeric one was invisible to this rule before.

Related CVE: CVE-2024-45590 - body-parser DoS vulnerability

Examples

❌ Incorrect

// An explicit limit well above what a request should be able to pin
app.use(express.json({ limit: '50mb' }));
app.use(express.urlencoded({ extended: true, limit: '100mb' }));

// The same limit written as a byte count
app.use(bodyParser.json({ limit: 52428800 }));

✅ Correct

// No options at all — Express's own 100kb default applies
app.use(express.json());
app.use(express.urlencoded({ extended: true }));

// With size limits - SAFE
app.use(express.json({ limit: '100kb' }));
app.use(express.urlencoded({ extended: true, limit: '100kb' }));

// body-parser with limits - SAFE
app.use(bodyParser.json({ limit: '1mb' }));
app.use(bodyParser.urlencoded({ limit: '1mb', extended: true }));

Options

{
  "rules": {
    "express-security/require-express-body-parser-limits": [
      "warn",
      {
        "allowInTests": true
      }
    ]
  }
}

Recommended Limits

When Not To Use It

Never disable in production. Always set appropriate request size limits.

Known False Negatives

The following patterns are not detected due to static analysis limitations:

Options from Variable

Why: Parser options stored in variables are not analyzed.

// ❌ NOT DETECTED - Options from variable
const jsonOpts = {}; // Missing limit!
app.use(express.json(jsonOpts));

Mitigation: Use inline options. Create typed secure defaults.

Spread Configuration

Why: Spread hides actual configuration.

// ❌ NOT DETECTED - Limit may be in spread or not
const base = getParserConfig(); // May not have limit
app.use(express.json({ ...base }));

Mitigation: Explicitly set limit. Don't rely on spread configs.

Custom Parser Middleware

Why: Non-standard parser middleware is not checked.

// ❌ NOT DETECTED - Custom parser
import { customParser } from '@company/parsers';
app.use(customParser.json()); // Limits?

Mitigation: Apply rule patterns to custom parsers.

Reverse Proxy Limits

Why: Infrastructure-level limits are not visible.

// ❌ NOT DETECTED (correctly) - Nginx handles limits
app.use(express.json()); // Nginx limits request size

Mitigation: Document infrastructure limits. Add code comment.

Further Reading

• CVE-2024-45590
• Express body-parser