diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Revision history for leb128-serialize
 
+## 1.1 -- 2020-06-08
+
+* Fix check for overlong encodings; it was not strict enough
+
 ## 1.0 -- 2020-04-23
 
 * First version. Released on an unsuspecting world.
diff --git a/leb128-cereal.cabal b/leb128-cereal.cabal
--- a/leb128-cereal.cabal
+++ b/leb128-cereal.cabal
@@ -1,6 +1,6 @@
 cabal-version:       >=1.10
 name:                leb128-cereal
-version:             1.0
+version:             1.1
 synopsis:            LEB128 and SLEB128 encoding
 description:
    This module implements encoding and decoding of 'Natural' and 'Integer'
diff --git a/src/Data/Serialize/LEB128.hs b/src/Data/Serialize/LEB128.hs
--- a/src/Data/Serialize/LEB128.hs
+++ b/src/Data/Serialize/LEB128.hs
@@ -182,6 +182,9 @@
     go !shift !w = do
       byte <- G.getWord8 <|> fail "short encoding"
       let !byteVal = fromIntegral (clearBit byte 7)
+      case bitSizeMaybe w of
+          Just bs | shift > bs -> fail "overflow"
+          _ -> return ()
       when (isFinite @a) $
         unless (byteVal `unsafeShiftL` shift `unsafeShiftR` shift == byteVal) $
           fail "overflow"
@@ -211,6 +214,9 @@
     go !prev !shift !w = do
         byte <- G.getWord8 <|> fail "short encoding"
         let !byteVal = fromIntegral (clearBit byte 7)
+        case bitSizeMaybe w of
+            Just bs | shift > bs -> fail "overflow"
+            _ -> return ()
         when (isFinite @a) $
           unless ((byteVal `unsafeShiftL` shift `unsafeShiftR` shift) .&. 0x7f == byteVal) $
             fail "overflow"