diff --git a/internal/api/handlers/v0/auth/common.go b/internal/api/handlers/v0/auth/common.go
index 2c81303..5d91047 100644
--- a/internal/api/handlers/v0/auth/common.go
+++ b/internal/api/handlers/v0/auth/common.go
@@ -21,8 +21,12 @@ import (
 	"github.com/modelcontextprotocol/registry/internal/config"
 )
 
-func readBody(r io.Reader) string {
-	b, _ := io.ReadAll(r)
+// readErrorBody reads an upstream error response body for inclusion in an
+// error message. The cap protects against a misbehaving upstream returning a
+// huge body — error diagnostics never need more than a few KB.
+func readErrorBody(r io.Reader) string {
+	const maxErrorBodySize = 8 * 1024
+	b, _ := io.ReadAll(io.LimitReader(r, maxErrorBodySize))
 	return string(b)
 }
 
diff --git a/internal/api/handlers/v0/auth/github_at.go b/internal/api/handlers/v0/auth/github_at.go
index b495f4d..af5e793 100644
--- a/internal/api/handlers/v0/auth/github_at.go
+++ b/internal/api/handlers/v0/auth/github_at.go
@@ -122,7 +122,7 @@ func (h *GitHubHandler) getGitHubUser(ctx context.Context, token string) (*GitHu
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("GitHub API error (status %d): %s", resp.StatusCode, readBody(resp.Body))
+		return nil, fmt.Errorf("GitHub API error (status %d): %s", resp.StatusCode, readErrorBody(resp.Body))
 	}
 
 	var user GitHubUserOrOrg
@@ -150,7 +150,7 @@ func (h *GitHubHandler) getGitHubUserOrgs(ctx context.Context, username string,
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("GitHub API error (status %d): %s", resp.StatusCode, readBody(resp.Body))
+		return nil, fmt.Errorf("GitHub API error (status %d): %s", resp.StatusCode, readErrorBody(resp.Body))
 	}
 
 	var orgs []GitHubUserOrOrg
diff --git a/internal/api/handlers/v0/auth/github_oidc.go b/internal/api/handlers/v0/auth/github_oidc.go
index 6a6761b..5ce38ac 100644
--- a/internal/api/handlers/v0/auth/github_oidc.go
+++ b/internal/api/handlers/v0/auth/github_oidc.go
@@ -148,7 +148,7 @@ func (v *GitHubOIDCValidator) fetchJWKS(ctx context.Context) (*JWKS, error) {
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("JWKS endpoint returned status %d: %s", resp.StatusCode, readBody(resp.Body))
+		return nil, fmt.Errorf("JWKS endpoint returned status %d: %s", resp.StatusCode, readErrorBody(resp.Body))
 	}
 
 	var jwks JWKS