diff --git a/src/http_server/flb_http_server.c b/src/http_server/flb_http_server.c
index f13b8e3c968..217f159b720 100644
--- a/src/http_server/flb_http_server.c
+++ b/src/http_server/flb_http_server.c
@@ -1411,7 +1411,10 @@ int flb_http_server_init_with_options(
     if (options->max_decoded_body_size == 0) {
         options->max_decoded_body_size = HTTP_SERVER_DEFAULT_MAX_DECODED_BODY_SIZE;
     }
-    else if (options->max_decoded_body_size == SIZE_MAX) {
+    else if (options->max_decoded_body_size > (SIZE_MAX >> 1)) {
+        /* negative sizes wrap into the high half of size_t. A cast to
+         * int64_t only looks negative when size_t is 64-bit; on 32-bit
+         * it zero-extends, so compare against the sign bit instead. */
         flb_error("[http server] invalid http_server.max_decoded_body_size");
         return -1;
     }
diff --git a/tests/internal/http_server.c b/tests/internal/http_server.c
index b15f478e71e..cf72b601ffd 100644
--- a/tests/internal/http_server.c
+++ b/tests/internal/http_server.c
@@ -10,6 +10,7 @@
 #include <fluent-bit/flb_network.h>
 #include <fluent-bit/flb_pthread.h>
 #include <fluent-bit/flb_socket.h>
+#include <fluent-bit/flb_utils.h>
 #include <fluent-bit/http_server/flb_http_server.h>
 #include <fluent-bit/http_server/flb_http_server_config_map.h>
 #include <fluent-bit/http_server/flb_hs.h>
@@ -209,6 +210,17 @@ void test_http_server_rejects_invalid_decoded_body_limit()
     TEST_CHECK(flb_http_server_init_with_options(&server, &options) == -1);
 }
 
+void test_http_server_rejects_negative_decoded_body_limit()
+{
+    struct flb_http_server server;
+    struct flb_http_server_options options;
+
+    flb_http_server_options_init(&options);
+    options.max_decoded_body_size = (size_t) flb_utils_size_to_bytes("-5M");
+
+    TEST_CHECK(flb_http_server_init_with_options(&server, &options) == -1);
+}
+
 void test_http_server_options_multi_worker_magic()
 {
     struct flb_config *config;
@@ -1328,6 +1340,8 @@ TEST_LIST = {
     { "http_request_compression_roundtrip", test_http_request_compression_roundtrip },
     { "http_server_rejects_invalid_decoded_body_limit",
       test_http_server_rejects_invalid_decoded_body_limit },
+    { "http_server_rejects_negative_decoded_body_limit",
+      test_http_server_rejects_negative_decoded_body_limit },
     { "http_body_inflation_limit", test_http_body_inflation_limit },
     { "http_body_inflation_budget", test_http_body_inflation_budget },
     { "http1_rejects_invalid_partial_request_line", test_http1_rejects_invalid_partial_request_line },