Large PDFs in Node.js without unlimited buffering

Processing large PDFs in Node.js applications is a technical challenge that many teams underestimate until their system collapses in production. The usual pattern of receiving the entire file in memory, parsing it with libraries such as pdf-lib, and returning a result works reasonably well in controlled environments, but as the volume of concurrent requests grows, the infrastructure begins to show worrying symptoms: V8 heap exhaustion, 413 errors in serverless functions, and a progressive increase in latency due to event loop blockages. Behind each of these flaws is not a code error, but an architectural decision that ignores the physical limits of a single Node process. The root of the problem is that the PDF format requires the parser to have access to the entire resident file in order to interpret the cross-reference table (xref) at the end. This prevents true streaming, but it is possible to control three critical variables: how many bytes enter the worker, where those bytes reside during the upload phase, and how many analyses are run in parallel. The most robust solution we've implemented at Q2BSTUDIO for projects handling sensitive documents is to separate the upstream path from the parsing path. The client sends the file directly to object storage (such as S3 or R2) using a pre-signed URL, and then passes the public URL to the verification endpoint. This way, the Node server never sees the bytes during the transfer phase, which is the most resource-intensive in terms of concurrency. The parsing worker downloads the PDF from the URL with a backpressure mechanism that limits the maximum size per file—for example, 10 MB—and aborts the connection if that limit is exceeded before the content arrives complete. This prevents a malicious or excessively large file from taking up memory unnecessarily. In addition, an explicit traffic light is implemented that limits the number of simultaneous analyses (between 2 and 6 depending on the worker's capacity), preventing the sum of the resident buffers from exceeding the available memory threshold. The result of this approach is that the latency profile becomes predictable even under high load. The original article describes in detail the implementation using fetch with AbortController, a byte counter in the read loop, and a bounded final concatenation. That technique, combined with a global timeout of 30 seconds and early verification of the Content-Length header, protects the worker from slowloris attacks and files that exceed the declared limit. In production, it is also essential to establish a budget of bytes in total flight per worker and monitor the heap used with tools such as clinic.js or the Node inspector. From a business perspective, handling large PDFs securely and efficiently is an increasingly common requirement in sectors such as fintech, health and legal, where bank documents, medical reports or contracts arrive with weights exceeding 5 MB. The bespoke applications we develop in Q2BSTUDIO integrate these practices natively, ensuring that the system is scalable without the need to oversize the infrastructure. Our AWS and Azure cloud services allow you to deploy architectures that separate storage from compute, using serverless functions with tight memory limits or dedicated workers on platforms such as Fly.io or Coolify. In addition, the detection of manipulations in PDFs – which is the main use case of the analysis – benefits from artificial intelligence techniques that identify re-editing signatures, such as changes in metadata, incremental update strings or discrepancies in dates. At Q2BSTUDIO we combine these capabilities with business intelligence services such as Power BI to visualize performance metrics and detect anomalous usage patterns. Cybersecurity also plays an important role: by preventing the server from receiving the file directly, the attack surface is reduced and the execution of malicious code embedded in the PDF is prevented. This is all part of a comprehensive approach we offer our customers, where AI agents can orchestrate document verification flows without human intervention. For teams looking for a production-ready solution, our recommendation is to start with a deployment that includes a concurrency limit, maximum file size, and timeout, and then monitor memory usage with tools like Sentry to detect regressions. If the volume exceeds what a single worker can handle, the natural next step is to introduce a multi-consumer work queue, a topic we cover in other articles. All in all, handling large PDFs in Node.js without unlimited buffering is not only possible, but necessary to maintain system stability. The key is to separate responsibilities, apply explicit limits and measure everything. At Q2BSTUDIO we help companies design and implement these architectures, combining custom software development, cloud computing, artificial intelligence and cybersecurity to create robust and future-proof solutions.