After seeing lighttpd grow to hundreds of megabytes I couldn’t sleep. It was like a tiny chicken has grown into a huge monster. After some experimenting I managed to grow monsters myself:
The source of the problem is that lighttpd ignores maximum request size setting and reads data until it fills all available memory.
Return to Apache? No way - lighttpd bugs are usually fixed lightning fast.