diff --git a/app/routes/profile.js b/app/routes/profile.js
index 9bc0557..105e597 100644
--- a/app/routes/profile.js
+++ b/app/routes/profile.js
@@ -41,6 +41,19 @@ function ProfileHandler (db) {
         // The Fix: Instead of using greedy quantifiers the same regex will work if we omit the second quantifier +
         // const regexPattern = /([0-9]+)\#/;
         const regexPattern = /[0-9]+\#/;
+        // Validate bankRouting input before regex to prevent DoS via excessive input length
+        if (typeof bankRouting !== 'string' || bankRouting.length > 50) {
+            return res.render("profile", {
+                updateError: "Bank Routing number format is invalid",
+                firstName,
+                lastName,
+                ssn,
+                dob,
+                address,
+                bankAcc,
+                bankRouting: ''
+            });
+        }
         // Allow only numbers with a suffix of the letter #, for example: 'XXXXXX#'
         const testComplyWithRequirements = regexPattern.test(bankRouting);
         // if the regex test fails we do not allow saving