--- a/plugins/mod_websocket.lua	Thu Sep 17 16:42:14 2020 +0100
+++ b/plugins/mod_websocket.lua	Thu Sep 17 16:42:36 2020 +0100
@@ -285,6 +285,10 @@
 		local frame, length = parse_frame(frameBuffer);
 
 		while frame do
+			if length > stanza_size_limit then
+				session:close({ condition = "policy-violation", text = "stanza too large" });
+				return;
+			end
 			frameBuffer:discard(length);
 			local result = handle_frame(frame);
 			if not result then return; end