Parsing JSON Bodies Safely

Safely parse request bodies and JSON payloads while protecting memory and preventing denial-of-service vulnerabilities.

On this page

Request Body as Stream

HTTP request bodies are streams. Never assume small payloads in production. Large or malicious payloads can exhaust memory.

let body = '';
req.on('data', chunk => {
  body += chunk;
});
req.on('end', () => {
  const data = JSON.parse(body);
});

Always enforce maximum body size limits. Validate JSON structure before usage. Avoid blocking parsing logic inside critical request paths.