403 block on PDF upload endpoint by managed_react_ruleset

Problem Summary: Our production PDF upload endpoint is returning a plain-text 403 Forbidden response. The request appears to be blocked by the platform-level React Server Components security mitigation (managed_react_ruleset) due to the binary PDF payload triggering the inspection pattern.

Troubleshooting Steps Completed: Verified package security with npx fix-react2shell-next. No vulnerable packages were found, and the application is already on React 19.2.0. Created and published a custom WAF Bypass rule for paths matching /api/past-papers/, but the request continues to be denied by the platform-level mitigation.

Since your custom bypass rule didn't change anything, the managed rule seems to be inspecting the binary body no matter what. Two things worth trying:

Keep the PDF out of your function entirely. Upload it straight from the browser to storage (Vercel Blob client uploads with upload() from @vercel/blob/client plus a small handleUpload route, or a presigned S3/R2 URL), then send your API only the file URL. This also gets you around the 4.5 MB request body limit on Vercel Functions, which bigger past papers would hit anyway.
If the file has to go through your API, test sending it as multipart/form-data instead of a raw binary body and see if the block still happens.

Either way, post the x-vercel-id value from one of the blocked 403 responses here so Vercel can look up exactly which rule fired for that path.

Since your custom bypass rule didn't change anything, the managed rule seems to be inspecting the binary body no matter what. Two things worth trying:

Keep the PDF out of your function entirely. Upload it straight from the browser to storage (Vercel Blob client uploads with upload() from @vercel/blob/client plus a small handleUpload route, or a presigned S3/R2 URL), then send your API only the file URL. This also gets you around the 4.5 MB request body limit on Vercel Functions, which bigger past papers would hit anyway.
If the file has to go through your API, test sending it as multipart/form-data instead of a raw binary body and see if the block still happens.

Either way, post the x-vercel-id value from one of the blocked 403 responses here so Vercel can look up exactly which rule fired for that path.