added docs for max_form_parts and default is 1000

docs/config.rst

@@ -259,6 +259,14 @@ The following configuration values are used internally by Flask:
 
     Default: ``None``
 
+.. py:data:: MAX_FORM_PARTS
+
+    Stop reading request data if more than this number
+    of parts are sent in multipart form data. This is useful to stop a very large number
+    of very small parts, especially file parts.
+
+    Default: ``1000``
+
 .. py:data:: TEMPLATES_AUTO_RELOAD
 
     Reload templates when they are changed. If not set, it will be enabled in

src/flask/app.py

@@ -309,7 +309,7 @@ class Flask(Scaffold):
             "SESSION_COOKIE_SAMESITE": None,
             "SESSION_REFRESH_EACH_REQUEST": True,
             "MAX_CONTENT_LENGTH": None,
-            "MAX_FORM_PARTS": 5000,
+            "MAX_FORM_PARTS": 1000,
             "SEND_FILE_MAX_AGE_DEFAULT": None,
             "TRAP_BAD_REQUEST_ERRORS": None,
             "TRAP_HTTP_EXCEPTIONS": False,

src/flask/wrappers.py

@@ -65,7 +65,7 @@ class Request(RequestBase):
         if current_app:
             return current_app.config["MAX_FORM_PARTS"]
         else:
-            return None
+            return 1000
 
     @property
     def endpoint(self) -> str | None: