diff --git a/internal/nas/nas_security/security.go b/internal/nas/nas_security/security.go
index d5ebe30d..a7d993c1 100644
--- a/internal/nas/nas_security/security.go
+++ b/internal/nas/nas_security/security.go
@@ -362,6 +362,9 @@ func DecodePlainNasNoIntegrityCheck(payload []byte) (*nas.Message, error) {
 
 	if msg.SecurityHeaderType != nas.SecurityHeaderTypePlainNas {
 		// remove security Header
+		if len(payload) < 7 {
+			return nil, fmt.Errorf("nas payload is too short")
+		}
 		payload = payload[7:]
 	}