So one option in #Vinyl_Cache is to check if you have any such requests:
vinyllog -dCq 'ReqHeader:Content-Type ~ multipart/form'
vinyllog -Cq 'ReqHeader:Content-Type ~ multipart/form'
The first command scans the in-memory log, the second runs until interrupted on live data.
If you do not see multipart/form-data requests, you can simply refuse them in VCL.
Another very simple option in #Vinyl_Cache is to limit the size of request bodies using std.cache_req_body(). This also has the added benefit that chunked transfer encoding is tuned into a request with a content-length, such that php can check it upfront against the maximum body size.
In the example, the maximum size should be adjusted accordingly.
https://vinyl-cache.org/docs/trunk/reference/vmod_std.html#std-cache-req-body
