Limit request sizes in the web server

CVE-2026-109618

This is a temporary setting. It reduces the risk but does not fix the bug. Update PHP to fix it for real.

The tool can't do this one for you. It belongs in your web server.

What

Limit request body size, number of form fields, upload parts, headers, and nesting depth. If your site never takes file uploads, block multipart requests completely. php.net gives no exact numbers, so pick limits that fit your site.

Examples

• Nginx: client_max_body_size 8m; and large_client_header_buffers 4 8k;
• Apache: LimitRequestBody 8388608, LimitRequestFields 50
• IIS: Request Filtering → maxAllowedContentLength
• Cloudflare / proxy / WAF: use its request size and header limits

Make sure the limit also applies to requests without a Content-Length header (chunked uploads).

Source: php.net