diff --git a/internal/api/middleware/limit.go b/internal/api/middleware/limit.go
new file mode 100644
index 0000000..e70c238
--- /dev/null
+++ b/internal/api/middleware/limit.go
@@ -0,0 +1,13 @@
+package middleware
+
+import "net/http"
+
+func WithMaxBytes(limit int64) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			r.Body = http.MaxBytesReader(w, r.Body, limit)
+
+			next.ServeHTTP(w, r)
+		})
+	}
+}
diff --git a/internal/api/request/list.go b/internal/api/request/list.go
index be4f909..f9c88e3 100644
--- a/internal/api/request/list.go
+++ b/internal/api/request/list.go
@@ -14,8 +14,6 @@ type CreateListPayload struct {
 func DecodeCreateList(r *http.Request) (CreateListPayload, error) {
 	var payload CreateListPayload
 
-	r.Body = http.MaxBytesReader(nil, r.Body, 1024*64)
-
 	decoder := json.NewDecoder(r.Body)
 	decoder.DisallowUnknownFields()
 
diff --git a/internal/api/router/router.go b/internal/api/router/router.go
index 8ca038f..a6cf4b7 100644
--- a/internal/api/router/router.go
+++ b/internal/api/router/router.go
@@ -28,6 +28,7 @@ func NewMux(cfg Config) http.Handler {
 	mux.HandleFunc("POST /lists", listHandler.CreateList)
 
 	var httpHandler http.Handler = mux
+	httpHandler = middleware.WithMaxBytes(1024 * 64)(httpHandler)
 	httpHandler = middleware.WithTelemetry(httpHandler)
 
 	return httpHandler