[johnnyhuirilef]

Hi! 🙂 The README says that the "input exceeded the depth" error is not thrown when depth is 32, the default. It is thrown. urlencoded always passes strictDepth: true to qs, so with the default configuration an input with 33 levels of nesting gets a 400.

const http = require('http')
const bodyParser = require('body-parser')
const parse = bodyParser.urlencoded({ extended: true })

const server = http.createServer((req, res) => {
  parse(req, res, (err) => res.end(err ? `${err.status} ${err.message}` : '200'))
}).listen(0, async () => {
  for (const n of [32, 33]) {
    const res = await fetch(`http://localhost:${server.address().port}`, {
      method: 'POST',
      headers: { 'content-type': 'application/x-www-form-urlencoded' },
      body: 'a' + '[a]'.repeat(n) + '=1'
    })
    console.log(`${n} levels: ${await res.text()}`)
  }
  server.close()
})

Output on 2.3.0 and on 1.20.8 (Node 24.21.0):

32 levels: 200
33 levels: 400 The input exceeded the depth

The existing tests in test/urlencoded.js ('when default value') already expect this: 32 levels pass, 33 return 400. This change replaces the last sentence of that section with the real behavior.

The 1.x branch has the same sentence. Happy to open a PR there too, or to change the wording 🙌

[krzysdz]

I have no idea what this was supposed to mean. Maybe @UlisesGascon changed his mind while writing the code, but forgot to update the docs. afd0f39

The test that checks if the error is thrown when the default depth limit is used:

body-parser/test/urlencoded.js

Lines 353 to 365 in 02101da

	it('should not parse beyond the specified depth', function (done) {
	let deepObject = 'a'
	for (let i = 0; i < 33; i++) {
	deepObject += '[p]'
	}
	deepObject += '=value'
	request(this.server)
	.post('/')
	.set('Content-Type', 'application/x-www-form-urlencoded')
	.send(deepObject)
	.expect(400, '[querystring.parse.rangeError] The input exceeded the depth', done)
	})