ErrorWeb/CORS
413 Payload Too Large
Why an upload or request returns 413 Payload Too Large, which layer's size limit is actually responsible, and how to raise it or shrink the payload.
Last updated
ErrorWeb/CORS
413 Payload Too Large (nginx shows: "413 Request Entity Too Large"; Express/body-parser shows: "PayloadTooLargeError: request entity too large")
What it means: The server rejected the request because its body — an upload, a JSON payload, a form submission — exceeds a size limit enforced somewhere in the stack; the exact wording differs by server, but status code 413 is consistent.
Likely causes
Most probable first — with how to confirm.
- 1.A reverse proxy in front of your app (nginx, Apache, a CDN or load balancer) has its own body-size limit smaller than your app's — nginx defaults to 1MB via `client_max_body_size`, a very common trip point for uploads.
- 2.Your framework's own body parser has a size limit (Express's body-parser and similar middleware commonly default to around 1MB) that's smaller than the payload being sent.
- 3.The client is genuinely sending more data than intended — an unoptimized image upload, a base64-encoded file (which inflates size by roughly a third), or an accidental duplicate payload.
- 4.A CDN or serverless hosting platform enforces a hard request-size ceiling that app-level configuration can't override.
Fixes
Safest first; destructive ones are called out.
- →Raise the limit closest to where the rejection actually happens — check the proxy first (nginx: `client_max_body_size 20M;`), then the framework's body-parser limit (Express: `express.json({ limit: '20mb' })`), since one low limit anywhere in the chain still produces a 413.
- →Reduce the payload instead: compress or resize images client-side before upload, or send binary data rather than base64, which shrinks the same file by roughly a quarter.
- →For genuinely large files, switch to a streamed or chunked upload, or a direct-to-storage upload via a signed URL, instead of pushing the whole file through your app server's request body.
- →On a serverless or managed platform, check its documented hard request-size cap — some won't let you raise it past a fixed ceiling regardless of app config.