diff --git a/pkg/registry/registry.go b/pkg/registry/registry.go
index e4c98dc..cef63fb 100644
--- a/pkg/registry/registry.go
+++ b/pkg/registry/registry.go
@@ -9,11 +9,12 @@ package registry
 import (
 	"context"
 	"fmt"
-	"github.com/cheatmd-dev/cheatmd/internal/httputil"
 	"io"
 	"strings"
 	"time"
 
+	"github.com/cheatmd-dev/cheatmd/internal/httputil"
+
 	yaml "go.yaml.in/yaml/v3"
 )
 
@@ -52,7 +53,8 @@ func Fetch(ctx context.Context, url string) (*Registry, error) {
 	}
 	defer respBody.Close()
 
-	data, err := io.ReadAll(respBody)
+	// Cap registry fetch to 5MB to prevent memory exhaustion
+	data, err := io.ReadAll(io.LimitReader(respBody, 5*1024*1024))
 	if err != nil {
 		return nil, fmt.Errorf("read registry body: %w", err)
 	}