diff --git a/nip19.test.ts b/nip19.test.ts
index 7648d69..b39e456 100644
--- a/nip19.test.ts
+++ b/nip19.test.ts
@@ -137,6 +137,10 @@ test('decode naddr from habla.news', () => {
   expect(pointer.identifier).toEqual('references')
 })
 
+test('decode malformed nevent should throw instead of infinite loop', () => {
+  expect(() => decode('nevent1qq5v4rkz')).toThrow()
+})
+
 test('decode naddr from go-nostr with different TLV ordering', () => {
   let { type, data } = decode(
     'naddr1qqrxyctwv9hxzq3q80cvv07tjdrrgpa0j7j7tmnyl2yr6yr7l8j4s3evf6u64th6gkwsxpqqqp65wqfwwaehxw309aex2mrp0yhxummnw3ezuetcv9khqmr99ekhjer0d4skjm3wv4uxzmtsd3jjucm0d5q3vamnwvaz7tmwdaehgu3wvfskuctwvyhxxmmd0zfmwx',
diff --git a/nip19.ts b/nip19.ts
index 2cc808a..377671c 100644
--- a/nip19.ts
+++ b/nip19.ts
@@ -182,6 +182,7 @@ function parseTLV(data: Uint8Array): TLV {
   let result: TLV = {}
   let rest = data
   while (rest.length > 0) {
+    if (rest.length < 2) throw new Error('not enough data to read TLV')
     let t = rest[0]
     let l = rest[1]
     let v = rest.slice(2, 2 + l)