Fix Next.js Server Actions Body Size Limit: Configuration and Troubleshooting

Quick Answer

• Default limit: Next.js Server Actions have a 1MB body size limit by default. Exceeding this causes a 413 Request Entity Too Large error.
• Minimal fix: Add serverActions.bodySizeLimit to your next.config.js file with a larger value (e.g., '5mb' or '10mb').
• CSRF protection: Use serverActions.allowedOrigins to allow external domains when needed; supports wildcard patterns like '*.my-proxy.com'.
• Version boundary: In Next.js 13, you must also set experimental.serverActions: true. Next.js 14+ enables Server Actions by default.
• Production check: Always account for multipart/form-data overhead (~10-20KB) when setting the limit, and validate file types/sizes server-side.

What Problem It Solves

Next.js Server Actions handle form submissions and data mutations on the server. By default, the request body size is capped at 1MB. This becomes a problem when your application needs to:

• Upload images, videos, or other media files
• Process large CSV or JSON payloads
• Handle complex forms with many fields or large text inputs

Without adjusting this limit, users will encounter 413 Request Entity Too Large errors, breaking the upload or form submission flow.

Minimal Working Configuration

Add or modify your next.config.js file:

JS
/** @type {import('next').NextConfig} */
const nextConfig = {
  serverActions: {
    bodySizeLimit: '5mb',
    allowedOrigins: ['my-proxy.com', '*.my-proxy.com'],
  },
}

module.exports = nextConfig

For Next.js 13, you also need to enable the experimental flag:

JS
const nextConfig = {
  experimental: {
    serverActions: true,
  },
  serverActions: {
    bodySizeLimit: '5mb',
  },
}

Parameters and Environment Variables

Root Cause Analysis

The 413 Request Entity Too Large error occurs because:

1. Default limit is conservative: Next.js sets a 1MB limit to prevent abuse and memory exhaustion.
2. Multipart overhead: When uploading files via forms, the multipart encoding adds ~10-20KB of metadata. If your file is exactly 1MB, the total request body exceeds the limit.
3. No granular control per action: The bodySizeLimit applies globally to all Server Actions. You cannot set different limits for different actions without manual checks inside the action handler.

Common Errors and Fixes

Production Notes and Security Checks

Production deployment recommendations:

• Always explicitly set bodySizeLimit in next.config.js rather than relying on the default
• Account for multipart/form-data overhead: if your max file is 5MB, set the limit to at least '5.1mb'
• The limit only applies to Server Actions, not API Routes or middleware
• In load-balanced or reverse-proxy environments, ensure the proxy doesn't modify request body size limits or timeouts

Security considerations:

• Always validate file types and sizes server-side within the Server Action
• Use allowedOrigins restrictively—only add domains you trust
• Consider implementing rate limiting to prevent DDoS attacks via large payloads
• Wildcard patterns in allowedOrigins (e.g., '*.my-proxy.com') are supported but should be used sparingly

FAQ

Q: Does bodySizeLimit affect all Server Actions?

A: Yes, the configuration applies globally to all Server Actions. Next.js doesn't currently support per-action limits. If you need different limits, implement manual size checks inside the action handler.

Q: How do I test if bodySizeLimit is working?

A: Create a simple Server Action that accepts a large payload, then send a request exceeding the limit using curl or Postman. Check for a 413 response. Also verify that your next.config.js is correctly loaded by adding a temporary console log.

Q: Does allowedOrigins support wildcards?

A: Yes, the official documentation shows examples using '*.my-proxy.com', indicating wildcard support. However, use this feature cautiously to avoid weakening CSRF protection.

Official References

• nextjs.org - serverActions configuration
• nextjs.org - serverActions configuration (Next.js 14)