feat: add body parser limit for server actions

packages/next/src/build/webpack-config.ts

@@ -773,8 +773,9 @@ export default async function getBaseWebpackConfig(
   const hasServerComponents = hasAppDir
   const disableOptimizedLoading = true
   const enableTypedRoutes = !!config.experimental.typedRoutes && hasAppDir
-  const serverActions = !!config.experimental.serverActions && hasAppDir
-  const bundledReactChannel = serverActions ? '-experimental' : ''
+  const useServerActions = !!config.experimental.serverActions && hasAppDir
+  const serverActionsSizeLimit = config.experimental.serverActionsSizeLimit
+  const bundledReactChannel = useServerActions ? '-experimental' : ''
 
   if (isClient) {
     if (
@@ -2418,7 +2419,8 @@ export default async function getBaseWebpackConfig(
               appDir,
               dev,
               isEdgeServer,
-              useServerActions: serverActions,
+              useServerActions: useServerActions,
+              serverActionsSizeLimit: serverActionsSizeLimit,
             })),
       hasAppDir &&
         !isClient &&

packages/next/src/build/webpack/plugins/flight-client-entry-plugin.ts

@@ -30,12 +30,14 @@ import {
 import { traverseModules, forEachEntryModule } from '../utils'
 import { normalizePathSep } from '../../../shared/lib/page-path/normalize-path-sep'
 import { getProxiedPluginState } from '../../build-context'
+import { SizeLimit } from '../../../../types'
 
 interface Options {
   dev: boolean
   appDir: string
   isEdgeServer: boolean
   useServerActions: boolean
+  serverActionsSizeLimit?: SizeLimit
 }
 
 const PLUGIN_NAME = 'ClientEntryPlugin'
@@ -151,13 +153,15 @@ export class ClientReferenceEntryPlugin {
   appDir: string
   isEdgeServer: boolean
   useServerActions: boolean
+  serverActionsSizeLimit?: SizeLimit
   assetPrefix: string
 
   constructor(options: Options) {
     this.dev = options.dev
     this.appDir = options.appDir
     this.isEdgeServer = options.isEdgeServer
     this.useServerActions = options.useServerActions
+    this.serverActionsSizeLimit = options.serverActionsSizeLimit
     this.assetPrefix = !this.dev && !this.isEdgeServer ? '../' : ''
   }
 
@@ -341,6 +345,15 @@ export class ClientReferenceEntryPlugin {
               'Server Actions require `experimental.serverActions` option to be enabled in your Next.js config: https://nextjs.org/docs/app/building-your-application/data-fetching/server-actions'
             )
           )
+        } else if (
+          this.serverActionsSizeLimit !== undefined &&
+          parseInt(this.serverActionsSizeLimit.toString()) < 1
+        ) {
+          compilation.errors.push(
+            new Error(
+              'Server Actions Size Limit must exceed 1 in number or filesize format to be enabled in your Next.js config: https://nextjs.org/docs/app/building-your-application/data-fetching/server-actions'
+            )
+          )
         } else {
           if (!actionMapsPerEntry[name]) {
             actionMapsPerEntry[name] = new Map()
@@ -444,6 +457,15 @@ export class ClientReferenceEntryPlugin {
                 'Server Actions require `experimental.serverActions` option to be enabled in your Next.js config: https://nextjs.org/docs/app/building-your-application/data-fetching/server-actions'
               )
             )
+          } else if (
+            this.serverActionsSizeLimit !== undefined &&
+            parseInt(this.serverActionsSizeLimit.toString()) < 1
+          ) {
+            compilation.errors.push(
+              new Error(
+                'Server Actions Size Limit must exceed 1 in number or filesize format to be enabled in your Next.js config: https://nextjs.org/docs/app/building-your-application/data-fetching/server-actions'
+              )
+            )
           } else {
             if (!actionMapsPerClientEntry[name]) {
               actionMapsPerClientEntry[name] = new Map()

packages/next/src/server/app-render/action-handler.ts

@@ -27,6 +27,7 @@ import {
   getModifiedCookieValues,
 } from '../web/spec-extension/adapters/request-cookies'
 import { RequestStore } from '../../client/components/request-async-storage'
+import { NextConfigComplete } from '../../server/config-shared'
 
 function nodeToWebReadableStream(nodeReadable: import('stream').Readable) {
   if (process.env.NEXT_RUNTIME !== 'edge') {
@@ -245,6 +246,7 @@ export async function handleAction({
   generateFlight,
   staticGenerationStore,
   requestStore,
+  nextConfig,
 }: {
   req: IncomingMessage
   res: ServerResponse
@@ -258,6 +260,7 @@ export async function handleAction({
   }) => Promise<RenderResult>
   staticGenerationStore: StaticGenerationStore
   requestStore: RequestStore
+  nextConfig?: NextConfigComplete
 }): Promise<undefined | RenderResult | 'not-found'> {
   let actionId = req.headers[ACTION.toLowerCase()] as string
   const contentType = req.headers['content-type']
@@ -372,7 +375,12 @@ export async function handleAction({
           } else {
             const { parseBody } =
               require('../api-utils/node') as typeof import('../api-utils/node')
-            const actionData = (await parseBody(req, '1mb')) || ''
+
+            const serverActionsSizeLimit =
+              nextConfig?.experimental?.serverActionsSizeLimit
+
+            const actionData =
+              (await parseBody(req, serverActionsSizeLimit ?? '1mb')) || ''
 
             if (isURLEncodedAction) {
               const formData = formDataFromSearchQueryString(actionData)

packages/next/src/server/app-render/app-render.tsx

@@ -72,6 +72,7 @@ import { handleAction } from './action-handler'
 import { NEXT_DYNAMIC_NO_SSR_CODE } from '../../shared/lib/lazy-dynamic/no-ssr-error'
 import { warn } from '../../build/output/log'
 import { appendMutableCookies } from '../web/spec-extension/adapters/request-cookies'
+import { PHASE_PRODUCTION_SERVER } from '../../shared/lib/constants'
 
 export const isEdgeRuntime = process.env.NEXT_RUNTIME === 'edge'
 
@@ -1596,6 +1597,14 @@ export async function renderToHTMLOrFlight(
       }
     )
 
+    const nextConfig = await renderOpts.loadConfig?.(
+      PHASE_PRODUCTION_SERVER,
+      '/',
+      undefined,
+      undefined,
+      true
+    )
+
     // For action requests, we handle them differently with a special render result.
     const actionRequestResult = await handleAction({
       req,
@@ -1606,6 +1615,7 @@ export async function renderToHTMLOrFlight(
       generateFlight,
       staticGenerationStore,
       requestStore,
+      nextConfig,
     })
 
     if (actionRequestResult === 'not-found') {

packages/next/src/server/app-render/types.ts

@@ -1,5 +1,6 @@
 import type { LoadComponentsReturnType } from '../load-components'
 import type { ServerRuntime } from '../../../types'
+import { NextConfigComplete } from '../../server/config-shared'
 import type { ClientReferenceManifest } from '../../build/webpack/plugins/flight-manifest-plugin'
 import type { NextFontManifest } from '../../build/webpack/plugins/next-font-manifest-plugin'
 
@@ -138,6 +139,13 @@ export type RenderOptsPartial = {
   originalPathname?: string
   isDraftMode?: boolean
   deploymentId?: string
+  loadConfig?: (
+    phase: string,
+    dir: string,
+    customConfig?: object | null,
+    rawConfig?: boolean,
+    silent?: boolean
+  ) => Promise<NextConfigComplete>
 }
 
 export type RenderOpts = LoadComponentsReturnType & RenderOptsPartial

packages/next/src/server/config-schema.ts

@@ -304,6 +304,16 @@ const configSchema = {
         serverActions: {
           type: 'boolean',
         },
+        serverActionsSizeLimit: {
+          oneOf: [
+            {
+              type: 'number',
+            },
+            {
+              type: 'string',
+            },
+          ] as any,
+        },
         extensionAlias: {
           type: 'object',
         },

packages/next/src/server/config-shared.ts

@@ -9,6 +9,7 @@ import {
 import { SubresourceIntegrityAlgorithm } from '../build/webpack/plugins/subresource-integrity-plugin'
 import { WEB_VITALS } from '../shared/lib/utils'
 import type { NextParsedUrlQuery } from './request-meta'
+import { SizeLimit } from '../../types'
 
 export type NextConfigComplete = Required<NextConfig> & {
   images: Required<ImageConfigComplete>
@@ -281,6 +282,11 @@ export interface ExperimentalConfig {
    * Enable `react@experimental` channel for the `app` directory.
    */
   serverActions?: boolean
+
+  /**
+   * Allows adjusting body parser size limit for server actions.
+   */
+  serverActionsSizeLimit?: SizeLimit
 }
 
 export type ExportPathMap = {

test/e2e/app-dir/actions/app-action-size-limit-invalid.test.ts

@@ -0,0 +1,80 @@
+import { createNextDescribe } from 'e2e-utils'
+
+createNextDescribe(
+  'app-dir action size limit invalid config',
+  {
+    files: __dirname,
+    skipDeployment: true,
+    dependencies: {
+      react: 'latest',
+      'react-dom': 'latest',
+      'server-only': 'latest',
+    },
+  },
+  ({ next, isNextStart }) => {
+    if (!isNextStart) {
+      it('skip test for dev mode', () => {})
+      return
+    }
+
+    beforeAll(async function () {
+      await next.stop()
+      await next.patchFile(
+        'next.config.js',
+        `
+      module.exports = {
+        experimental: {
+          serverActions: true,
+          serverActionsSizeLimit: -3000,
+        },
+      }
+      `
+      )
+      try {
+        await next.build()
+      } catch {}
+    })
+
+    beforeAll(async function () {
+      await next.stop()
+      await next.patchFile(
+        'next.config.js',
+        `
+      module.exports = {
+        experimental: {
+          serverActions: true,
+          serverActionsSizeLimit: 'testmb',
+        },
+      }
+      `
+      )
+      try {
+        await next.build()
+      } catch {}
+    })
+
+    beforeAll(async function () {
+      await next.stop()
+      await next.patchFile(
+        'next.config.js',
+        `
+      module.exports = {
+        experimental: {
+          serverActions: true,
+          serverActionsSizeLimit: '-3000mb',
+        },
+      }
+      `
+      )
+      try {
+        await next.build()
+      } catch {}
+    })
+
+    it('should error if serverActionsSizeLimit config is invalid', async function () {
+      expect(next.cliOutput).toContain(
+        'Server Actions Size Limit must exceed 1 in number or filesize format'
+      )
+    })
+  }
+)