The default ceiling on document text, in UTF-16 code units (§96).
32 Mi units — roughly 32–96 MB of UTF-8, depending on the script. Chosen so
that no plausible authored scene or recording meets it while a runaway or
hostile response is refused before JSON.parse allocates a parse tree for
it. Code units rather than bytes because that is what a decoded string
can report without re-encoding it; a UTF-8 body is never smaller than its
code-unit count, so the check is conservative in the safe direction — it can
accept something slightly larger than the nominal budget, never reject
something smaller.
The default ceiling on document text, in UTF-16 code units (§96).
32 Mi units — roughly 32–96 MB of UTF-8, depending on the script. Chosen so that no plausible authored scene or recording meets it while a runaway or hostile response is refused before
JSON.parseallocates a parse tree for it. Code units rather than bytes because that is what a decodedstringcan report without re-encoding it; a UTF-8 body is never smaller than its code-unit count, so the check is conservative in the safe direction — it can accept something slightly larger than the nominal budget, never reject something smaller.