AIKIDO-2026-571543

TL;DR

The body-limit middleware compares Content-Length against the configured maximum before processing the request body. On AWS Lambda adapters the request is built from a fully buffered payload while copying the client-declared Content-Length verbatim. A client can declare a tiny Content-Length while sending a much larger body and pass the size check. The adapters now derive Content-Length from the actual buffered body bytes so the middleware limit is enforced.