diff --git a/lib/bcoin/protocol/parser.js b/lib/bcoin/protocol/parser.js
index d40cdb93..7fe11f41 100644
--- a/lib/bcoin/protocol/parser.js
+++ b/lib/bcoin/protocol/parser.js
@@ -455,6 +455,8 @@ Parser.parseInv = function parseInv(p) {
 
   count = p.readVarint();
 
+  assert(count < 50000, 'Item count too high.');
+
   for (i = 0; i < count; i++) {
     items.push({
       type: p.readU32(),