Skip to content

Add maximum size limit for postponed body parsing#88175

Merged
wyattjoh merged 3 commits intocanaryfrom
wyattjoh/postponed-body-limit
Jan 7, 2026
Merged

Add maximum size limit for postponed body parsing#88175
wyattjoh merged 3 commits intocanaryfrom
wyattjoh/postponed-body-limit

Conversation

@wyattjoh
Copy link
Copy Markdown
Contributor

@wyattjoh wyattjoh commented Jan 6, 2026

What?

Adds a configurable experimental.maxPostponedStateSize limit for PPR postponed state body parsing to prevent OOM/DoS attacks.

Why?

The postponed state body was read entirely without size limits, creating a potential denial-of-service vector through unbounded memory allocation.

How?

Enforces a 100 MB default limit (configurable via next.config.js) with byte counting during body parsing. Returns HTTP 413 when exceeded with a helpful error message directing users to increase the limit if needed.

Comment thread packages/next/src/server/base-server.ts Outdated
Comment thread packages/next/src/server/base-server.ts
@nextjs-bot
Copy link
Copy Markdown
Contributor

nextjs-bot commented Jan 6, 2026

Tests Passed

@nextjs-bot
Copy link
Copy Markdown
Contributor

nextjs-bot commented Jan 6, 2026

Stats from current PR

🔴 2 regressions

Metric Canary PR Change Trend
node_modules Size 457 MB 457 MB 🔴 +265 kB (+0%) ▁████
Warm (First Request) 341ms 385ms 🔴 +44ms (+13%)
📊 All Metrics
📖 Metrics Glossary

Dev Server Metrics:

  • Listen = TCP port starts accepting connections
  • First Request = HTTP server returns successful response
  • Cold = Fresh build (no cache)
  • Warm = With cached build artifacts

Build Metrics:

  • Fresh = Clean build (no .next directory)
  • Cached = With existing .next directory

Change Thresholds:

  • Time: Changes < 50ms AND < 10%, OR < 2% are insignificant
  • Size: Changes < 1KB AND < 1% are insignificant
  • All other changes are flagged to catch regressions

⚡ Dev Server

Metric Canary PR Change
Cold (Listen) 455ms 455ms
Cold (First Request) 1.186s 1.143s
Warm (Listen) 456ms 457ms
Warm (First Request) 341ms 385ms 🔴 +44ms (+13%)
📦 Dev Server (Webpack) (Legacy)

📦 Dev Server (Webpack)

Metric Canary PR Change
Cold (Listen) 456ms 456ms
Cold (First Request) 1.875s 1.878s
Warm (Listen) 456ms 456ms
Warm (First Request) 1.866s 1.873s

⚡ Production Builds

Metric Canary PR Change
Fresh Build 4.127s 4.121s
Cached Build 4.097s 4.124s
📦 Production Builds (Webpack) (Legacy)

📦 Production Builds (Webpack)

Metric Canary PR Change Trend
Fresh Build 14.171s 14.239s
Cached Build 14.306s 14.346s
node_modules Size 457 MB 457 MB 🔴 +265 kB (+0%) ▁████
📦 Bundle Sizes

Bundle Sizes

⚡ Turbopack

Client

Main Bundles: **430 kB** → **430 kB** ⚠️ +10 B

82 files with content-based hashes (individual files not comparable between builds)

Server

Middleware
Canary PR Change
middleware-b..fest.js gzip 787 B 791 B
Total 787 B 791 B ⚠️ +4 B
Build Details
Build Manifests
Canary PR Change
_buildManifest.js gzip 447 B 452 B 🔴 +5 B (+1%)
Total 447 B 452 B ⚠️ +5 B

📦 Webpack

Client

Main Bundles
Canary PR Change
2086.HASH.js gzip 169 B N/A -
2161-HASH.js gzip 5.4 kB N/A -
2747-HASH.js gzip 4.48 kB N/A -
4322-HASH.js gzip 52.5 kB N/A -
ec793fe8-HASH.js gzip 62.3 kB N/A -
framework-HASH.js gzip 59.8 kB 59.8 kB
main-app-HASH.js gzip 250 B 253 B 🔴 +3 B (+1%)
main-HASH.js gzip 38.4 kB 38.8 kB
webpack-HASH.js gzip 1.68 kB 1.69 kB
1596.HASH.js gzip N/A 169 B -
2658-HASH.js gzip N/A 52.2 kB -
6349-HASH.js gzip N/A 4.46 kB -
7019-HASH.js gzip N/A 5.42 kB -
b17a3386-HASH.js gzip N/A 62.3 kB -
Total 225 kB 225 kB ⚠️ +125 B
Polyfills
Canary PR Change
polyfills-HASH.js gzip 39.4 kB 39.4 kB
Total 39.4 kB 39.4 kB
Pages
Canary PR Change
_app-HASH.js gzip 194 B 193 B
_error-HASH.js gzip 182 B 182 B
css-HASH.js gzip 336 B 335 B
dynamic-HASH.js gzip 1.8 kB 1.8 kB
edge-ssr-HASH.js gzip 256 B 256 B
head-HASH.js gzip 352 B 349 B
hooks-HASH.js gzip 385 B 384 B
image-HASH.js gzip 580 B 580 B
index-HASH.js gzip 259 B 258 B
link-HASH.js gzip 2.5 kB 2.51 kB
routerDirect..HASH.js gzip 319 B 317 B
script-HASH.js gzip 385 B 387 B
withRouter-HASH.js gzip 316 B 315 B
1afbb74e6ecf..834.css gzip 106 B 106 B
Total 7.97 kB 7.96 kB ✅ -8 B

Server

Edge SSR
Canary PR Change
edge-ssr.js gzip 124 kB 124 kB
page.js gzip 239 kB 240 kB 🔴 +1.85 kB (+1%)
Total 363 kB 365 kB ⚠️ +1.86 kB
Middleware
Canary PR Change
middleware-b..fest.js gzip 653 B 657 B
middleware-r..fest.js gzip 155 B 156 B
middleware.js gzip 32.7 kB 33 kB
edge-runtime..pack.js gzip 846 B 846 B
Total 34.4 kB 34.6 kB ⚠️ +267 B
Build Details
Build Manifests
Canary PR Change
_buildManifest.js gzip 738 B 738 B
Total 738 B 738 B
Build Cache
Canary PR Change
0.pack gzip 3.62 MB 3.62 MB 🔴 +4.62 kB (+0%)
index.pack gzip 100 kB 101 kB
index.pack.old gzip 99.5 kB 99.7 kB
Total 3.82 MB 3.83 MB ⚠️ +5.01 kB

🔄 Shared (bundler-independent)

Runtimes
Canary PR Change
app-page-exp...dev.js gzip 302 kB 303 kB
app-page-exp..prod.js gzip 157 kB 158 kB
app-page-tur...dev.js gzip 302 kB 302 kB
app-page-tur..prod.js gzip 157 kB 158 kB
app-page-tur...dev.js gzip 299 kB 299 kB
app-page-tur..prod.js gzip 155 kB 156 kB
app-page.run...dev.js gzip 299 kB 299 kB
app-page.run..prod.js gzip 155 kB 156 kB
app-route-ex...dev.js gzip 68.7 kB 68.7 kB
app-route-ex..prod.js gzip 47.5 kB 47.5 kB
app-route-tu...dev.js gzip 68.7 kB 68.7 kB
app-route-tu..prod.js gzip 47.5 kB 47.5 kB
app-route-tu...dev.js gzip 68.3 kB 68.3 kB
app-route-tu..prod.js gzip 47.3 kB 47.3 kB
app-route.ru...dev.js gzip 68.3 kB 68.3 kB
app-route.ru..prod.js gzip 47.3 kB 47.3 kB
dist_client_...dev.js gzip 324 B 324 B
dist_client_...dev.js gzip 326 B 326 B
dist_client_...dev.js gzip 318 B 318 B
dist_client_...dev.js gzip 317 B 317 B
pages-api-tu...dev.js gzip 41.1 kB 41.1 kB
pages-api-tu..prod.js gzip 31.2 kB 31.2 kB
pages-api.ru...dev.js gzip 41 kB 41 kB
pages-api.ru..prod.js gzip 31.2 kB 31.2 kB
pages-turbo....dev.js gzip 50.8 kB 50.8 kB
pages-turbo...prod.js gzip 38.2 kB 38.2 kB
pages.runtim...dev.js gzip 50.7 kB 50.7 kB
pages.runtim..prod.js gzip 38.2 kB 38.2 kB
server.runti..prod.js gzip 60 kB 62.2 kB 🔴 +2.23 kB (+4%)
Total 2.68 MB 2.68 MB ⚠️ +3.45 kB
📝 Changed Files (9 files)

Files with changes:

  • app-page-exp..ntime.dev.js
  • app-page-exp..time.prod.js
  • app-page-tur..ntime.dev.js
  • app-page-tur..time.prod.js
  • app-page-tur..ntime.dev.js
  • app-page-tur..time.prod.js
  • app-page.runtime.dev.js
  • app-page.runtime.prod.js
  • server.runtime.prod.js
View diffs
app-page-exp..ntime.dev.js
failed to diff
app-page-exp..time.prod.js

Diff too large to display

app-page-tur..ntime.dev.js
failed to diff
app-page-tur..time.prod.js

Diff too large to display

app-page-tur..ntime.dev.js
failed to diff
app-page-tur..time.prod.js

Diff too large to display

app-page.runtime.dev.js
failed to diff
app-page.runtime.prod.js

Diff too large to display

server.runtime.prod.js

Diff too large to display

@wyattjoh wyattjoh force-pushed the wyattjoh/postponed-body-limit branch 5 times, most recently from 3007a48 to 86e5d45 Compare January 7, 2026 00:05
Copy link
Copy Markdown
Contributor Author

wyattjoh commented Jan 7, 2026

This stack of pull requests is managed by Graphite. Learn more about stacking.

@wyattjoh wyattjoh force-pushed the wyattjoh/postponed-body-limit branch from 86e5d45 to a438be1 Compare January 7, 2026 00:09
@vercel
Copy link
Copy Markdown
Contributor

vercel Bot commented Jan 7, 2026

Notifying the following users due to files changed in this PR based on this repo's notify modifiers:

@timneutkens, @ijjk, @shuding, @huozhi:

packages/next/src/server/config.ts

Copy link
Copy Markdown
Contributor

@vercel vercel Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Additional Suggestion:

Missing config-time validation for maxPostponedStateSize - only runtime validation exists, preventing early error detection

View Details
📝 Patch Details
diff --git a/packages/next/src/server/config.ts b/packages/next/src/server/config.ts
index 2856ed1930..951a0f1688 100644
--- a/packages/next/src/server/config.ts
+++ b/packages/next/src/server/config.ts
@@ -771,6 +771,29 @@ function assignDefaultsAndValidate(
     }
   }
 
+  // Validate & normalize experimental.maxPostponedStateSize
+  if (typeof result.experimental?.maxPostponedStateSize !== 'undefined') {
+    const bytes =
+      require('next/dist/compiled/bytes') as typeof import('next/dist/compiled/bytes')
+    const maxPostponedStateSize = result.experimental.maxPostponedStateSize
+    let value: number | null
+
+    if (typeof maxPostponedStateSize === 'number') {
+      value = maxPostponedStateSize
+    } else {
+      value = bytes.parse(maxPostponedStateSize)
+    }
+
+    if (value === null || isNaN(value) || value < 1) {
+      throw new Error(
+        'Max Postponed State Size must be a valid number (bytes) or filesize format string (e.g., "5mb"): https://nextjs.org/docs/app/api-reference/config/next-config-js/max-postponed-state-size'
+      )
+    }
+
+    // Store the normalized value as a number
+    result.experimental.maxPostponedStateSize = value
+  }
+
   // Throw if both Middleware and Proxy config are set.
   if (
     userConfig.experimental?.proxyClientMaxBodySize !== undefined &&

Analysis

The issue was valid. Prior to this fix, maxPostponedStateSize only had runtime validation (in base-server.ts, lines 1064-1075) that would trigger an error only when a PPR resume request is made. In contrast, similar config options like bodySizeLimit and proxyClientMaxBodySize had config-time validation at startup, providing clearer error messages earlier in the initialization process.

The fix adds config-time validation for maxPostponedStateSize in packages/next/src/server/config.ts (after line 771), following the exact same pattern as bodySizeLimit:

  1. Check if the config value is defined
  2. Import the bytes library
  3. Handle both number and string inputs
  4. Validate the parsed value (not null, not NaN, >= 1)
  5. Throw a clear error if invalid
  6. Normalize and store the value as a number in the result config

This ensures that invalid maxPostponedStateSize values are caught immediately when the config is loaded, rather than waiting for a PPR resume request at runtime. The runtime validation in base-server.ts remains as a safety check but becomes effectively unreachable for invalid configs.

Comment on lines +216 to +218
const maxDecompressedSize = maxPostponedStateSizeBytes
? maxPostponedStateSizeBytes * 5
: 500 * 1024 * 1024
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Inconsistent size calculation when maxPostponedStateSizeBytes is undefined. The bytes library parses "100 MB" as 100,000,000 bytes (decimal MB), so 5x = 500,000,000 bytes. However, the hardcoded fallback uses 500 * 1024 * 1024 = 524,288,000 bytes (binary MiB). This creates a ~24 MB discrepancy depending on whether the config was explicitly set or uses the default.

const maxDecompressedSize = maxPostponedStateSizeBytes
  ? maxPostponedStateSizeBytes * 5
  : 500_000_000 // Match the parsed "100 MB" * 5
Suggested change
const maxDecompressedSize = maxPostponedStateSizeBytes
? maxPostponedStateSizeBytes * 5
: 500 * 1024 * 1024
const maxDecompressedSize = maxPostponedStateSizeBytes
? maxPostponedStateSizeBytes * 5
: 500_000_000 // Match the parsed "100 MB" * 5

Spotted by Graphite Agent

Fix in Graphite


Is this helpful? React 👍 or 👎 to let us know.

…attacks

Adds a configurable experimental.maxPostponedStateSize limit (default 10 MB) that enforces a maximum size for PPR postponed state bodies. This prevents potential OOM exploits from unbounded body reads.

When the limit is exceeded, the server returns HTTP 413 with a helpful error message directing users to increase the limit in their next.config.js if needed.
… limit dynamic

- Update default `maxPostponedStateSize` from 10MB to 100MB
- Make decompression limit dynamic (5x the configured limit) instead of hardcoded 50MB
- Extract `parseMaxPostponedStateSize` helper to consolidate the default handling
- Pass config through render pipeline to resume data cache creation
@wyattjoh wyattjoh force-pushed the wyattjoh/postponed-body-limit branch from 433d72c to bfac3d7 Compare January 7, 2026 03:32
- Add missing maxPostponedStateSizeBytes parameter to createRenderResumeDataCache calls
- Fix serverActions.bodySizeLimit validation to use bytes.parse() instead of parseInt()
@wyattjoh wyattjoh force-pushed the wyattjoh/postponed-body-limit branch from bfac3d7 to a07891c Compare January 7, 2026 04:52
@wyattjoh wyattjoh merged commit 45dba91 into canary Jan 7, 2026
292 of 296 checks passed
@wyattjoh wyattjoh deleted the wyattjoh/postponed-body-limit branch January 7, 2026 05:19
@github-actions github-actions Bot locked as resolved and limited conversation to collaborators Jan 24, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants