Visitar URL original
fix: allow a field value exactly at the fieldSize limit by MaxFreedomPollard · Pull Request #1481 · expressjs/multer · GitHub
Skip to content

fix: allow a field value exactly at the fieldSize limit - #1481

Merged
UlisesGascon merged 2 commits into
expressjs:mainfrom
MaxFreedomPollard:fix/field-size-exact
Oct 21, 2026
Merged

UlisesGascon merged 2 commits into
expressjs:mainfrom
MaxFreedomPollard:fix/field-size-exact

Conversation

@MaxFreedomPollard

Copy link
Copy Markdown
Contributor

A text field whose value is exactly limits.fieldSize bytes is rejected with LIMIT_FIELD_VALUE. Every other limit in multer is inclusive: fileSize, parts, files, fields and fieldNameSize all accept a request sitting exactly on the limit. Set limits: { fieldSize: 5 }, send the 5 byte value hello, and you get err.code === 'LIMIT_FIELD_VALUE' with err.field === 'field0', while hell goes through. Busboy also defaults fieldSize to a finite 1MB, so multer().none() with no limits rejects exactly 1048576 bytes, against README.md:307, "Max field value size (in bytes) | 1MB".

Busboy marks a field part truncated as soon as the value reaches the limit, at node_modules/busboy/lib/types/multipart.js:502, where fieldSize === fieldSizeLimit sets partTruncated = true. Multer turns the resulting valueTruncated straight into an error at lib/make-middleware.js:262. It already compensates for this busboy convention in the block at lib/make-middleware.js:92 to 113, but only for two of the three limits: line 107 passes limits.fileSize + 1, line 111 passes limits.parts + 1, and fieldSize is never adjusted. Those two came in with fix: allow files at exact fileSize limit and fix: allow exactly limits.parts parts. Busboy's finite default sits at multipart.js:251.

The change gives fieldSize the same treatment. busboyLimits is now built unconditionally from the caller's limits, and fieldSize goes to busboy one higher, so truncation is reported only once the limit is genuinely exceeded. That adjustment runs even with no caller limits, so a new DEFAULT_FIELD_SIZE constant pins busboy's 1MB in multer rather than inheriting it; if busboy changes its default, multer's effective limit no longer tracks it. I checked the edge cases by running them: Infinity passes through untouched and a 3MB value is accepted, 0 accepts an empty value and rejects one byte, and null falls back to the same 1MB busboy uses.

Verification on Node 22.23.2, macOS 26.2. With only the four new tests applied to unmodified main, npx mocha --reporter spec --exit --check-leaks test/error-handling.js --grep "fieldSize" gives 2 passing and 2 failing, both AssertionError: ifError got unwanted exception: Field value too long; with the lib change all four pass. The full suite goes from 165 passing to 169 passing, 2 pending and 0 failing either way, and npm run lint is clean. The third and fourth tests post 1048576 and 1048577 bytes through multer().none(), the true zero-options default, which the explicit fieldSize: 5 tests cannot reach. The fourth also passes on main, so it pins the default rather than regressing.

Busboy marks a field value truncated the moment its size reaches
limits.fieldSize, and multer turns that into LIMIT_FIELD_VALUE, so a value
exactly at the limit was rejected. Multer already compensates for the same
busboy convention by passing fileSize and parts one higher; fieldSize now gets
the same treatment. The adjustment is applied even when the caller passed no
limits, because busboy defaults fieldSize to a finite 1MB while fileSize and
parts default to Infinity, so the documented 1MB default was off by one too.
An Infinity fieldSize is still passed through untouched.

@UlisesGascon UlisesGascon left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome work @MaxFreedomPollard! Thanks!

@UlisesGascon UlisesGascon self-assigned this Oct 21, 2026
@UlisesGascon
UlisesGascon merged commit 7661ce7 into expressjs:main Oct 21, 2026
51 checks passed
@UlisesGascon UlisesGascon mentioned this pull request Oct 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants