Strip $ and . with express-mongo-sanitize, strip HTML with xss-clean, trim and normalize with Zod, validate types and constraints, use runValidators on updates, whitelist filter fields, cap body size, remove duplicate query params with hpp, cast explicitly, avoid $where, set security headers with helmet, use httpOnly cookies, and rate limit auth routes.

Use express-mongo-sanitize to strip $ and . from req.body, req.params, and req.query. Validate types with Zod (objects where strings are expected are rejected). Use Mongoose (casts based on schema). Cast inputs explicitly with String(). Avoid $where.

express.json({ limit: '10kb' }) prevents oversized payload attacks. Without a limit, a malicious client can send huge bodies, eating memory and slowing the server. Set a sensible limit based on your largest expected request.