diff --git a/fuzzing/Makefile b/fuzzing/Makefile
index 0c17ebf..f20a238 100644
--- a/fuzzing/Makefile
+++ b/fuzzing/Makefile
@@ -1,8 +1,8 @@
 # You can select which sanitizer to use by setting this
 SANITIZER ?= address
 # These are set by OSS-Fuzz, we default to AddressSanitizer
-CXXFLAGS ?= -DLIBUS_NO_SSL -fsanitize=$(SANITIZER),fuzzer
-CFLAGS ?= -DLIBUS_NO_SSL
+override CXXFLAGS += -DLIBUS_NO_SSL -fsanitize=$(SANITIZER),fuzzer
+override CFLAGS += -DLIBUS_NO_SSL
 OUT ?= .
 
 oss-fuzz:
diff --git a/src/WebSocketContext.h b/src/WebSocketContext.h
index fb96fa9..014e980 100644
--- a/src/WebSocketContext.h
+++ b/src/WebSocketContext.h
@@ -100,6 +100,11 @@ private:
                 if (!webSocketData->fragmentBuffer.length()) {
                     webSocketData->fragmentBuffer.reserve(length + remainingBytes);
                 }
+                /* Fragments forming a big message are not caught until appending them */
+                if (refusePayloadLength(length + webSocketData->fragmentBuffer.length(), webSocketState, s)) {
+                    forceClose(webSocketState, s);
+                    return true;
+                }
                 webSocketData->fragmentBuffer.append(data, length);
 
                 /* Are we done now? */