https://github.com/goldbergyoni/nodebestpractices/blob/master/sections/security/requestpayloadsizelimit.md
Also investigate using req.is to check files are csv/xlsx
req.is