Bug Description
The uploadNotes middleware is configured to use multer.memoryStorage() with a file size limit of 15MB. Memory storage buffers the entire file in RAM before passing it to the controller. An attacker can send multiple concurrent requests containing 15MB payloads. Since Node.js has a default heap limit of ~1.4GB, just 100 concurrent requests will consume 1.5GB of RAM, immediately crashing the server with an Out-of-Memory (OOM) error.
Steps to Reproduce
- Write a script to send 100 concurrent POST requests to /api/notes-summary/save or any PDF upload route.
- Attach a 15MB dummy PDF to each request.
- Observe the Node.js server crashing with a FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory.
Expected Behavior
File uploads should be streamed directly to disk using multer.diskStorage() or processed via a streaming parser (like busboy) to maintain a low and predictable memory footprint.
Actual Behavior
The entire file is buffered into RAM concurrently, making the server highly vulnerable to Denial of Service (DoS) attacks.
Severity
Critical
Screenshots / Screen Recording
No response
Browser
No response
Operating System
No response
Additional Context
Located in backend/middlewares/uploadMiddleware.js.
Bug Description
The uploadNotes middleware is configured to use multer.memoryStorage() with a file size limit of 15MB. Memory storage buffers the entire file in RAM before passing it to the controller. An attacker can send multiple concurrent requests containing 15MB payloads. Since Node.js has a default heap limit of ~1.4GB, just 100 concurrent requests will consume 1.5GB of RAM, immediately crashing the server with an Out-of-Memory (OOM) error.
Steps to Reproduce
Expected Behavior
File uploads should be streamed directly to disk using multer.diskStorage() or processed via a streaming parser (like busboy) to maintain a low and predictable memory footprint.
Actual Behavior
The entire file is buffered into RAM concurrently, making the server highly vulnerable to Denial of Service (DoS) attacks.
Severity
Critical
Screenshots / Screen Recording
No response
Browser
No response
Operating System
No response
Additional Context
Located in backend/middlewares/uploadMiddleware.js.