---

id: b05b67af-8f59-4937-9107-8bee57577889 title: Pages inbox quota stops checking at 1000 objects; rate map has no hard cap state: closed labels:

• kind:security assignees: [] milestone: null created: 2026-10-27T19:38:20.426674442Z updated: 2026-10-27T19:53:10.601819764Z

---

Problem

The Pages inbox quota is only checked against the first 1000 R2 objects. overQuota calls bucket.list({ limit: Math.min(limit, 1000) }) once; if INBOX_QUOTA is above 1000, submissions keep being stored after the limit because the returned list can never reach the configured quota.

Verified with the real onRequestPost and a fake bucket containing 1001 objects, INBOX_QUOTA=1500:

status 200 stored 1002

Expected 503. functions/inbox/[kind].js:276-279.

The isolate-local rate-limit map also has no hard cap: it only prunes expired entries when size > 10000, so an attacker rotating source IPs can keep growing it. Cloudflare's WAF rule is the documented durable control, but the in-function map should still fail closed at a fixed key limit like serve's RATE_MAX_KEYS (f0rge #65).

Fix

• Paginate bucket.list with cursor until limit objects are counted or the list ends.
• Add a hard MAX_KEYS check for new rate-limit keys after the expiry sweep.
• Add Node tests for quota 1500 and the rate-map cap.