Home Assistant now limits how much data a client can send to the parts of its API that work without a login. A pull request merged into the development branch late on 26 October 2026 caps those requests at 64 KiB. Until now they inherited limits meant for something else entirely: 16 MiB for HTTP requests and 4 MiB for the first WebSocket message.

Where the old limits came from

The 16 MiB limit dates from January 2020 (pull request #30608) and was meant for the Supervisor proxy, ingress and audio and video streams. The authentication endpoints simply inherited it. According to the pull request, the request body was parsed before anything else was checked, while a real login request takes a few kilobytes. So anyone who could reach the instance, for example over the internet, could make it read and parse megabytes per request without knowing a password.

What the limit covers

  • Views can now set a max_body_size. Home Assistant applies it before the handler runs, so it also works for validators that read the body first.
  • The 64 KiB limit applies to the login flow, /auth/token, /auth/revoke and the onboarding views available before the first user exists: creating the user, waiting for integrations and restoring a backup. A larger request gets HTTP 413. Uploading a backup file during onboarding keeps the default limit, so restoring from a large backup still works.
  • During the WebSocket authentication phase, a first message larger than 64 KiB closes the connection before the message is parsed or the token checked. The pull request is open about the limits of this: aiohttp has already received the frame by then, up to its 4 MiB max_msg_size, so the change saves the JSON parsing and token validation, not the memory for the frame.

What it means for you

Normal use does not change, because a login, token refresh or onboarding step sends far less than 64 KiB. The change is listed as a bug fix, not a breaking change. The pull request does not mention a CVE or a reported attack, so this is hardening, and it matters most for instances reachable from the internet.

It follows earlier work on the login path in this cycle. Two fixes merged on 19 October already stopped parallel login attempts from slipping past IP bans and the limit of MFA retries. The new pull request has no milestone yet. It was merged before the 2026.11 beta, which is scheduled for 28 October, so it should arrive with 2026.11 unless it is reverted.