fix: reject compressed request bodies in every body parser

apps/admin-api/src/main.ts

@@ -62,7 +62,7 @@ if (cloudflareAccessMiddleware) {
 app.use(httpLogger);
 app.use(requestContextMiddleware);
 app.use(cookieParser());
-app.use(express.json({ limit: '1mb' }));
+app.use(express.json({ limit: '1mb', inflate: false }));
 
 app.use('/auth', authRoutes);
 app.use('/api', apiRoutes);

apps/api/src/app/routes/csp-report.routes.ts

@@ -42,7 +42,7 @@ function toOriginAndPath(value: unknown): string | undefined {
 routes.post(
   '/',
   cspReportRateLimit,
-  json({ type: ['application/csp-report', 'application/reports+json', 'application/json'], limit: '100kb' }),
+  json({ type: ['application/csp-report', 'application/reports+json', 'application/json'], limit: '100kb', inflate: false }),
   (req: express.Request, res: express.Response) => {
     try {
       const body = req.body;

apps/api/src/app/routes/webhook.routes.ts

@@ -13,7 +13,7 @@ const webhookRateLimit = createRateLimit('webhook', {
   keyGenerator: rateLimitGetKeyGenerator(),
 });
 
-routes.use(raw({ type: 'application/json' }));
+routes.use(raw({ type: 'application/json', inflate: false }));
 
 routes.post('/stripe', webhookRateLimit, billingController.webhook.controllerFn());
 routes.post('/mailgun', webhookRateLimit, mailgunWebhookController.webhook.controllerFn());

apps/api/src/main.ts

@@ -319,10 +319,12 @@ if (ENV.NODE_ENV === 'production' && !ENV.CI && cluster.isPrimary) {
   // handles the report payload instead of the 20mb global JSON parser, and responds 204.
   app.use('/api/csp-report', cspReportRoutes);
 
-  app.use(raw({ limit: '30mb', type: ['text/csv'] }));
-  app.use(raw({ limit: '30mb', type: ['application/zip'] }));
-  app.use(json({ limit: '20mb', type: ['json'] }));
-  app.use(urlencoded({ extended: true }));
+  // inflate: false - no client sends compressed request bodies; rejecting Content-Encoding (415) keeps
+  // untrusted input away from zlib/brotli decoders (e.g. CVE-2026-111497)
+  app.use(raw({ limit: '30mb', type: ['text/csv'], inflate: false }));
+  app.use(raw({ limit: '30mb', type: ['application/zip'], inflate: false }));
+  app.use(json({ limit: '20mb', type: ['json'], inflate: false }));
+  app.use(urlencoded({ extended: true, inflate: false }));
 
   // Must run after sessionMiddleware (which loads req.session) and before any route handler,
   // so an expired pending-verification session is destroyed before a route can observe it.

apps/geo-ip-api/src/main.ts

@@ -26,8 +26,8 @@ if (ENV.ENVIRONMENT !== 'development' && (!ENV.GEO_IP_API_USERNAME || !ENV.GEO_I
 
 const app = express();
 
-app.use(json({ limit: '20mb' }));
-app.use(urlencoded({ extended: true }));
+app.use(json({ limit: '20mb', inflate: false }));
+app.use(urlencoded({ extended: true, inflate: false }));
 app.use(httpLogger);
 app.use(requestContextMiddleware);