expressjs / expressjs/multer

File size limit cancels file upload only after all bytes are received

Open
#344 33 comments 51 reactions 1 assignee Claimed by @jonchurch View on GitHub
bug
Dominant language
JavaScript
Stars
12.1k
Forks
1.1k
Avg merge
8d 2h
Merged PRs (30d)
21

Description

I've been using multer for file uploads, and I've noticed an issue with the file size limit. I'm using the limits option to prevent the upload of files that are too large.

``` javascript
const upload = multer({
storage: multer.memoryStorage(),
limits: {
fieldNameSize: 255,
fileSize: 500000,
files: 1,
fields: 1
}
});
```

When uploading an image to my API, multer seems to wait until it has received all of the image bytes before failing with the "LIMIT_FILE_SIZE" code.

Isn't it a security vulnerability if your API allows someone to upload an arbitrarily large file _before_ failing the request? Is there another technique for preventing the behavior?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.