Skip to content
Critiq Docs

Search docs

Search documentation pages and rules

security.misconfiguration

Set explicit Express body parser and multer size limits

Express and Body Parser middleware plus Multer should declare explicit payload limits.

#Metadata

Rule ID
ts.security.express-unbounded-body-parser
Severity
medium
Confidence
0.78
Languages
javascript, typescript
Presets
recommended, security, strict
Stability
experimental
Applies to
block
Tags
express, rules-catalog, security

#Why it matters

Default limits drift across frameworks and deployments; explicit caps reduce oversized-request abuse.

#Remediation

Pass `limit` options to JSON/urlencoded/raw/text parsers and `limits.fileSize` (or equivalent) to Multer.

#Repository path

The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.express-unbounded-body-parser.rule.yaml.