Wrap req.Body with io.LimitReader bounded to 4 KiB before io.ReadAll. The DERP verify payload is a few hundred bytes.