From 3479c957a9b7bab9a8d5eafae98c73088784ec97 Mon Sep 17 00:00:00 2001
From: Phillip Barta <barta.phillip@gmail.com>
Date: Mon, 6 Jul 2026 18:56:30 +0200
Subject: [PATCH] fix: avoid mutating read options when reading body

The parser read options were created once per middleware instance and reused for each request. `read()` was aliasing that shared object and adding per-request `length` and `encoding` fields before passing it to `raw-body`.

Pass `raw-body` an explicit `rawBodyOptions` object containing the per-request values it needs.
---
 lib/read.js | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/lib/read.js b/lib/read.js
index bf1a1df4..f79e042a 100644
--- a/lib/read.js
+++ b/lib/read.js
@@ -79,38 +79,37 @@ function read (req, res, next, parse, debug, options) {
   }
 
   let length
-  const opts = options
   let stream
 
-  // read options
-  const verify = opts.verify
+  const verify = options.verify
 
   try {
     // get the content stream
-    stream = contentstream(req, debug, opts.inflate)
+    stream = contentstream(req, debug, options.inflate)
     length = stream.length
     stream.length = undefined
   } catch (err) {
     return next(err)
   }
 
-  // set raw-body options
-  opts.length = length
-  opts.encoding = verify
-    ? null
-    : encoding
-
   // assert charset is supported
-  if (opts.encoding === null && encoding !== null && !iconv.encodingExists(encoding)) {
+  if (verify && encoding !== null && !iconv.encodingExists(encoding)) {
     return next(createError(415, 'unsupported charset "' + encoding.toUpperCase() + '"', {
       charset: encoding.toLowerCase(),
       type: 'charset.unsupported'
     }))
   }
 
+  // set raw-body options
+  const rawBodyOptions = {
+    length,
+    encoding: verify ? null : encoding,
+    limit: options.limit
+  }
+
   // read body
   debug('read body')
-  getBody(stream, opts, function (error, body) {
+  getBody(stream, rawBodyOptions, function (error, body) {
     if (error) {
       let _error