Express query parser depth and pagination limit enforcement

Goal is to bound query string input and enforce safe pagination defaults for large dataset endpoints in Express 4.x and 5.x.

Body parser limit configuration caps request body size but does not apply to query string parameters. The default query parser uses qs with a depth limit and no size limit, and Express does not provide a built-in way to cap the number of query parameters or the length of a single parameter value. Pagination is typically implemented by reading limit and offset from the query string, and Express does not enforce a maximum for those values. The behavior of body parser limit is version sensitive because Express 5 removes the built-in middleware.

What default maximum should be applied to pagination limit and offset parameters for a central policy? How can a consistent constraint be applied across routes without per-route duplication? Does the query parser configuration affect practical limits on parameter count or nesting depth?