Picture a request that's completely well-formed, no injection anywhere. How can the input itself still take your Node service down?

So valid input can still be a denial of service if it just makes the server do too much work. There's the JSON bomb, a payload that's small to send but really expensive to parse or expand, like a deeply nested structure. And ReDoS, regular expression denial of service, where a crafted input triggers catastrophic backtracking in a badly written regex, so the match takes a very long time and the process basically hangs. The defense is limits, mostly. Set a maximum request body size so huge payloads get rejected, cap the nesting depth, and write regexes to avoid the patterns that are prone to backtracking. In Express you'd configure the body parser's size limit. Validate input against a schema, reject anything oversized or malformed early, and keep regexes with nested quantifiers away from user input. Rate limiting helps too, it caps how many expensive requests one client can send. You want to bound what any single request can consume.