Hard ceiling, in bytes, on the request body this middleware will PARSE (default 50 MB). The effective bound is min(maxSize * 2 + framing allowance, maxBodyBytes), so raising maxSize raises the bound only up to this ceiling.

It bounds the parse THIS middleware triggers and the per-part copies that parse produces — not the initial read. Nothing is read ahead of the first consumer since the body became memoized-lazy in the HTTP adapter (M87), and RuntimePlugin({ maxBodyBytes }) (M90a) bounds the read itself — that runtime bound is the one covering every reader, including a CSRF middleware that parsed the same form before this middleware ran (M94b), which is why this parse is no longer necessarily the request's first. The read still cannot be declined: IRequest exposes no body stream, so capping it for every reader needs a streaming request body, a framework-level change.