# Missing Input Size Limits

> Detects API endpoints without request body size limits, enabling denial of service via oversized payloads.

- Skill: `zakirkun/missing-input-size-limits` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/missing-input-size-limits`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/missing-input-size-limits/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/missing-input-size-limits

---


# Missing Input Size Limits

## Overview
APIs without request body size limits are vulnerable to:
- Memory exhaustion by sending multi-gigabyte request bodies
- CPU exhaustion via large JSON/XML documents requiring expensive parsing
- Storage DoS if large uploads are buffered to disk

## Remediation
- Set explicit body size limits: Express default is 100kb, consider 1MB max for most APIs
- Use streaming parsers for large uploads instead of buffering in memory
- Implement per-user upload quota