AIKIDO-2026-10704

TL;DR

The body size limit middleware wrapped request bodies in a streaming counter that updated asynchronously while downstream handlers could still run first when Content-Length was missing or bodies were chunked. Handlers that returned early, read only part of the stream, or masked read errors could therefore finish with a successful status before the limit decision was applied, so oversized payloads sometimes reached application logic despite the configured maximum. The implementation now buffers and enforces the limit before invoking next() so the documented guarantee that oversized requests are rejected before business logic runs is restored.