diff --git a/src/mux_h2.c b/src/mux_h2.c
index b60f306..c2e9774 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -2779,6 +2779,11 @@ static int h2_frt_decode_headers(struct h2s *h2s, struct buffer *buf, int count)
 			goto fail;
 		}
 
+		if (flen < 5) {
+			h2c_error(h2c, H2_ERR_FRAME_SIZE_ERROR);
+			goto fail;
+		}
+
 		hdrs += 5; // stream dep = 4, weight = 1
 		flen -= 5;
 	}