I'm not sure about the limiting stream. Probably it's the only solution, but with this solution we are moving the validation to the user. We can't handly it properly in our middleware.
The user has to know that the request body can throw an exceeding exception...