Next.js Body Exceeded 1 MB Limit: Causes and Fix

"Body exceeded 1 MB limit" is the error Next.js throws when a Server Action request is larger than its body size limit, which is 1 MB by default. A form that uploads a photo or a PDF works on a laptop, then fails after deployment with that error, and developers who raise the limit sometimes see the same error again or a different 413 error with a different number.

A file upload passes through several limits, and each one fails in its own way. This page maps all of them: the Next.js default, the setting that changes it, the Vercel Functions cap behind it, the places where the setting does not apply, and what a developer can do about each. Every number comes from the Next.js and Vercel documentation as it read on November 10, 2026, with the page dates given. Where the documentation is silent, the text says so. If you are choosing a framework partly for its server features, Is TanStack Start production ready compares TanStack Start with Next.js.

What is the Next.js Server Actions body size limit?

The limit is 1 MB per request by default. The Next.js serverActions configuration page (last updated August 26, 2026) says: "By default, the maximum size of the request body sent to a Server Action is 1MB, to prevent the consumption of excessive server resources in parsing large amounts of data, as well as potential DDoS attacks."

The Server Actions guide (last updated October 15, 2026) lists the cap as a built-in protection next to the CSRF origin check, so it is a deliberate guard. Two details from the configuration page decide whether a file fits:

• The whole body counts. The limit applies to "the raw HTTP request body, including the bytes that multipart/form-data adds for boundaries, part headers, and field metadata."
• Overhead is real. The page suggests leaving "an additional 10–20 KB" of room for typical multipart uploads.

Why do you get "Body exceeded 1 MB limit" in Next.js?

The error means the request body was larger than the configured Server Actions limit, and Next.js rejected it before your action code ran. Developers search for it with variants such as "body exceeded 1 mb limit nextjs," "error body exceeded 1 mb limit" and "413 body exceeded 1mb limit," which are suggestions that Google Autocomplete returned for the phrase on November 10, 2026.

The history explains why so many threads exist. On May 17, 2023, a developer opened GitHub discussion 49891 after file uploads failed and the old bodyParser.sizeLimit config had no effect:

For a wider view of where front-end work is heading, see Is frontend development dead in 2026. So the limit stopped being hardcoded in mid-2023. Any article or answer from before July 2023 that calls the limit fixed is out of date.

How do you change the Server Actions body size limit?

Set serverActions.bodySizeLimit in next.config. The documentation says it "can take the number of bytes or any string format supported by bytes, for example 1000, '500kb' or '3mb'." The example on the page nests the option as experimental.serverActions.bodySizeLimit with the value '2mb', and the page does not say whether a top-level serverActions key works in your version, so the nested form is the documented one.

Two limits on that setting matter:

• It is one value for the whole app. The configuration page documents no per-action option. A 5 MB limit for an avatar form is a 5 MB limit for every Server Action.
• Higher is riskier. The guide describes each action as a public POST route and says to "treat every action as an untrusted entry point." The default exists to cap the cost of parsing large bodies, so set the value close to the largest file you accept, and validate size and type inside the action as well.

How big a file fits under the limit?

A file must be smaller than the limit because the multipart wrapper takes part of it. Reading 1 MB as 1,024 KB (the usual binary reading; the page defers to the bytes package, which was not opened for this post, so this is an assumption), the 10–20 KB overhead rule gives:

A file that shows as exactly 1 MB in a file manager will not fit under the default. To measure a real request body, the cURL to fetch converter turns a copied request into code you can test, and it runs in your browser.

What three limits does a file upload pass?

A Server Action runs as a POST request, and that request meets three checkpoints:

Vercel's Functions limits page (last updated August 24, 2026) says: "The maximum payload size for the request body or the response body of a Vercel Function is 4.5 MB." A larger request returns the 413 error FUNCTION_PAYLOAD_TOO_LARGE, and the response limit does not apply to streamed responses. The order in the table is the order on Vercel. The pages read do not describe the order on other hosts, and they do not name Server Actions, so treating a Server Action POST as a Vercel Function request is an inference.

Other products document upload limits the same way. Our Gemini file upload limit reference separates app limits from API limits and gives each number its source.

Why do you still get a 413 after raising the limit?

The lowest limit in the chain wins, so the error text tells you which one fired. The table applies the limits to six file sizes on a Vercel deployment, using 20 KB of overhead and the binary reading above. It is the calculation of this page, not an official table.

The two bottom rows surprise people: Next.js accepts the file and the host refuses it. A second cause appears in self-hosted apps. GitHub discussion 77505 (opened March 25, 2025) reports a limit set to 100 MB while production logs still showed "Body exceeded 1 MB limit," on Next.js ^15.2.2 in Docker with output: "standalone". The thread has no maintainer reply, and the fixes come from community members:

• The poster's accepted answer (January 20, 2026) changed the Dockerfile: with the standalone output the next start command is not available, so the final CMD line that starts the server mattered most.
• A commenter (October 20, 2025) suggested copying next.config into the image.
• Another reported (December 28, 2025) that "70MB" plus the copied config worked.

The pattern is a config file that never reached the running server, not a broken setting. When a project behaves differently on a laptop and a server, the env file diff checker compares two .env files without sending them anywhere.

Does bodySizeLimit apply to Route Handlers and proxy?

No setting on the route.js page limits the body of a Route Handler. That Next.js page (last updated April 30, 2026) shows request.formData() and request.json() for reading bodies and mentions no size option, so the serverActions.bodySizeLimit setting is specific to Server Actions. Route Handlers on Vercel still meet the 4.5 MB platform cap, and self-hosted apps meet whatever limits their proxy sets.

A separate setting applies when the app uses proxy. The proxyClientMaxBodySize page (experimental, last updated October 20, 2025) says Next.js "clones the request body and buffers it in memory," that the default maximum is 10MB, and that above it "the body will only be buffered up to the limit." Then:

1. Next.js logs a warning naming the route.
2. The request continues, with only the partial body available.
3. The request does not fail or return an error to the client.

That behavior differs from the 1 MB rejection: a large upload through a proxy can arrive truncated with no error. To check which routes a proxy or middleware matcher covers, the Next.js middleware matcher tester runs in the browser.

Can you catch the body size error?

Developers report that they cannot catch it in the action. In discussion 49891, commenters wrote on November 24, 2024 that a try/catch around the form action did not work, on December 18, 2024 that production shows an "Application Error," and on January 13, 2025 that server logs showed an uncaught exception with status 413. One commenter suggested checking file.size on the client before uploading (January 27, 2025), and the earlier reporter said it worked well.

The Next.js error handling guide (last updated October 15, 2026) supports the same direction: it says to model expected errors as return values and to send uncaught exceptions to error boundaries. A file that is too large is an expected case, so a client-side size check, sized to the configured limit, gives users a message before the request fails. This page treats that as a reasonable practice drawn from the reports, not as documented behavior.

How do you upload files larger than 4.5 MB on Vercel?

Send the file around the function. Vercel's client uploads guide (last updated September 15, 2026) says: "When you need to upload files larger than 4.5 MB, you can use client uploads. The file goes directly from the browser to Vercel Blob." A server route authenticates the user and issues a token, and the guide warns that without that check "your upload route is open to the public."

The FUNCTION_PAYLOAD_TOO_LARGE error page lists the full set of options: reduce the payload, upload directly to Vercel Blob, split the data into chunks across several requests, or use external storage. The first option on that list, sending less data, can be as simple as converting a photo to a smaller format before upload; the in-browser image converter does that, and you should check the resulting size. The pages read for this post do not rank the options, so this page does not either. With this route the Server Action carries a small reference to the stored file, and the 1 MB default can stay where it is.

What should you do now?

Match the symptom to the limit before changing anything:

Then set the limit just above the largest file you accept, allow 10–20 KB for the wrapper, and move anything above a few megabytes to a direct-to-storage upload. Our guide to every free tool and guide on Blogs Byte lists the browser-based developer tools in one place.

What we still don't know

• Whether a top-level serverActions key works without experimental in your Next.js version. The documentation example uses experimental.
• How bytes converts "mb" into a number. This page used the binary reading and said so.
• Whether Vercel's 4.5 MB cap applies to Server Action POSTs in every deployment mode, because the pages do not name Server Actions.
• Which limits other hosts and reverse proxies apply. Check your host's own documentation, because platform rules change, as the Deno Deploy shutdown date coverage shows.
• What the maintainers recommend for the production-only reports in discussion 77505. The thread has no maintainer reply.
• Whether the error will become catchable. The reports describe it as uncaught today.

FAQs

What is the Next.js server actions body size limit?

It is 1 MB by default. The Next.js documentation says the maximum size of the request body sent to a Server Action is 1MB, and you can change it with serverActions.bodySizeLimit.

How do I increase the Server Actions body size limit in Next.js?

Set serverActions.bodySizeLimit in next.config to a number of bytes or a string such as '500kb' or '3mb'. The documentation example places it under experimental.serverActions.

Can I set bodySizeLimit for just one Server Action?

The configuration page documents one value for the whole app and no per-action setting. Validate the size inside each action if you need a stricter rule for one form.

Does bodySizeLimit apply to Route Handlers?

The route.js documentation lists no body-size option, so the setting is specific to Server Actions. Route Handlers still meet the host's cap, which is 4.5 MB on Vercel Functions.

Why do I get a 413 on Vercel after raising the limit?

Vercel Functions reject request bodies above 4.5 MB with the error FUNCTION_PAYLOAD_TOO_LARGE, whatever your Next.js setting says. Upload large files directly to storage such as Vercel Blob. For file limits in other products, NotebookLM vs ChatGPT compares source limits by plan.

Is a large bodySizeLimit a security risk?

The Next.js documentation says the 1 MB default exists to prevent excessive resource use and DDoS attacks, and the Server Actions guide says to treat every action as an untrusted entry point. Keep the value close to your largest real upload and validate inside the action.

Sources

• Next.js documentation, serverActions configuration (nextjs.org/docs/app/api-reference/config/next-config-js/serverActions), page dated August 26, 2026.
• Next.js documentation, "Server Actions and Mutations" guide (nextjs.org/docs/app/guides/server-actions), page dated October 15, 2026.
• Next.js documentation, route.js (page dated April 30, 2026), proxyClientMaxBodySize (page dated October 20, 2025) and "Error Handling" (page dated October 15, 2026).
• Vercel documentation, "Vercel Functions Limits" (page dated August 24, 2026), error FUNCTION_PAYLOAD_TOO_LARGE, and "Client Uploads with Vercel Blob" (page dated September 15, 2026).
• GitHub, vercel/next.js discussions 49891 (opened May 17, 2023) and 77505 (opened March 25, 2025).
• Google Autocomplete (US, November 10, 2026) for the query variants named above.

We opened all pages on November 10, 2026. Written by Blogs Byte Editorial. Check the linked pages again before relying on a number, because Next.js and Vercel change these limits.