File size limit cancels file upload only after all bytes are received

I’ve been using multer for file uploads, and I’ve noticed an issue with the file size limit. I’m using the limits option to prevent the upload of files that are too large.

  const upload = multer({
    storage: multer.memoryStorage(),
    limits: {
      fieldNameSize: 255,
      fileSize: 500000,
      files: 1,
      fields: 1
    }
  });

When uploading an image to my API, multer seems to wait until it has received all of the image bytes before failing with the “LIMIT_FILE_SIZE” code.

Isn’t it a security vulnerability if your API allows someone to upload an arbitrarily large file before failing the request? Is there another technique for preventing the behavior?

[linus-hologram]

Is there any update in regards to this issue? Does this really persist since 2016?

[DiegoRBaquero]

PR sent: https://github.com/expressjs/multer/pull/447