CVE-2026-32145

@@ -5,6 +5,8 @@
 - The Mist web server related module has been moved to the `wisp_mist` adapter
   package. A `wisp_ewe` package has been created too!
 - `send_file` failing will now result in an internal server error being sent.
+- Fixed a bug where the max body sizes would not be respected for chunked
+  request body streams.
 
 ## v2.2.1 - 2026-03-08
 

@@ -1172,6 +1172,7 @@ fn multipart_body(
     http.MoreRequiredForBody(chunk, parse) -> {
       let parse = fn_with_bad_request_error(parse, invalid_form)
       let reader = BufferedReader(reader, <<>>)
+      use quota <- result.try(decrement_quota(quota, size_read))
       use data <- result.try(append(data, chunk))
       multipart_body(reader, parse, boundary, chunk_size, quota, append, data)
     }
@@ -1242,6 +1243,8 @@ fn multipart_headers(
         }
       }
       let reader = BufferedReader(reader, <<>>)
+      let size_read = bit_array.byte_size(chunk)
+      use quotas <- result.try(decrement_body_quota(quotas, size_read))
       multipart_headers(reader, parse, chunk_size, quotas)
     }
   }
@@ -2000,18 +2003,26 @@ pub fn get_cookie(
 // Testing
 //
 
-// TODO: chunk the body
 @internal
 pub fn create_canned_connection(
   body: BitArray,
   secret_key_base: String,
 ) -> internal.Connection {
-  internal.make_connection(
-    fn(_size) {
-      Ok(internal.Chunk(body, fn(_size) { Ok(internal.ReadingFinished) }))
-    },
-    secret_key_base,
-  )
+  internal.make_connection(canned_reader(body), secret_key_base)
+}
+
+fn canned_reader(data: BitArray) -> internal.Reader {
+  fn(chunk_size) {
+    case bit_array.byte_size(data) {
+      0 -> Ok(internal.ReadingFinished)
+      size -> {
+        let take = int.min(chunk_size, size)
+        let assert Ok(chunk) = bit_array.slice(data, 0, take)
+        let assert Ok(rest) = bit_array.slice(data, take, size - take)
+        Ok(internal.Chunk(chunk, canned_reader(rest)))
+      }
+    }
+  }
 }
 
 /// Protects against Cross-Site Request Forgery (CSRF) attacks by checking the

@@ -885,6 +885,49 @@ Content-Disposition: form-data; name=\"one\"\r
     )
 }
 
+// https://github.com/gleam-wisp/wisp/issues/108
+pub fn multipart_form_body_too_big_across_chunks_test() {
+  let data = "--b\r
+Content-Disposition: form-data; name=\"x\"\r
+\r
+" <> string.repeat("A", 200) <> "\r
+--b--\r
+"
+  assert simulate.request(http.Post, "/")
+    |> simulate.string_body(data)
+    |> request.set_header("content-type", "multipart/form-data; boundary=b")
+    |> wisp.set_max_body_size(120)
+    |> wisp.set_read_chunk_size(100)
+    |> form_handler(fn(_) { panic as "should be unreachable" })
+    == Response(
+      413,
+      [#("content-type", "text/plain")],
+      wisp.Text("Content too large"),
+    )
+}
+
+// https://github.com/gleam-wisp/wisp/issues/108
+pub fn multipart_form_headers_too_big_across_chunks_test() {
+  let data =
+    "--b\r
+Content-Disposition: form-data; name=\"x\"\r
+\r
+1\r
+--b--\r
+"
+  assert simulate.request(http.Post, "/")
+    |> simulate.string_body(data)
+    |> request.set_header("content-type", "multipart/form-data; boundary=b")
+    |> wisp.set_max_body_size(10)
+    |> wisp.set_read_chunk_size(4)
+    |> form_handler(fn(_) { panic as "should be unreachable" })
+    == Response(
+      413,
+      [#("content-type", "text/plain")],
+      wisp.Text("Content too large"),
+    )
+}
+
 pub fn multipart_form_no_boundary_test() {
   let data =
     "--theboundary\r