Maximum request-body size, in bytes, enforced where the body is actually read. Omitted, the read is unbounded — the released behaviour.

This is the layer a request header cannot switch off. HttpSecurityPlugin({ requestSize: { maxBodySize } }) refuses on a declared Content-Length before anything is read, which is cheaper and reports earlier; a chunked request declares no length, so only the read itself can bound it. Set both, and set this one to the same value or higher.