diff --git a/src/core/lib/COBS.mjs b/src/core/lib/COBS.mjs
index 7dd925fd..e480fbcf 100644
--- a/src/core/lib/COBS.mjs
+++ b/src/core/lib/COBS.mjs
@@ -4,6 +4,8 @@
  * @license Apache-2.0
  */
 
+import OperationError from "../errors/OperationError.mjs";
+
 /**
  * COBS-encode a byte array
  * @param {Uint8Array} data
@@ -23,7 +25,7 @@ export function toCobs(data) {
         if ((endIndex < 0 || endIndex > 254) && data.length > 254) {
             output.push(255);
             output.push(...data.slice(1, 255));
-            data = [...data.slice(255)];
+            data = data.slice(255);
             if (data.length !== 0) {
                 data = [0, ...data];
             }
@@ -51,6 +53,10 @@ export function fromCobs(data) {
         return new Uint8Array();
     }
 
+    if (data.findIndex((value) => value === 0) >= 0) {
+        throw new OperationError("Could not decode from COBS: payload must not contain a 0x00 byte");
+    }
+
     const output = [];
 
     while (data.length > 0) {
diff --git a/tests/operations/tests/COBS.mjs b/tests/operations/tests/COBS.mjs
index cdc8717a..a8c37c5f 100644
--- a/tests/operations/tests/COBS.mjs
+++ b/tests/operations/tests/COBS.mjs
@@ -428,4 +428,49 @@ TestRegister.addTests([
             }
         ]
     },
+    {
+        "name": "From COBS Invalid input #1",
+        "input": "00 48 45 4C 4C 4F",
+        "expectedOutput": "Could not decode from COBS: payload must not contain a 0x00 byte",
+        "recipeConfig": [
+            {
+                "op": "From Hex",
+                "args": ["Auto"]
+            },
+            {
+                "op": "From COBS",
+                "args": []
+            }
+        ],
+    },
+    {
+        "name": "From COBS Invalid input #2",
+        "input": "48 45 00 4C 4C 4F",
+        "expectedOutput": "Could not decode from COBS: payload must not contain a 0x00 byte",
+        "recipeConfig": [
+            {
+                "op": "From Hex",
+                "args": ["Auto"]
+            },
+            {
+                "op": "From COBS",
+                "args": []
+            }
+        ],
+    },
+    {
+        "name": "From COBS Invalid input #3",
+        "input": "48 45 4C 4C 4F 00",
+        "expectedOutput": "Could not decode from COBS: payload must not contain a 0x00 byte",
+        "recipeConfig": [
+            {
+                "op": "From Hex",
+                "args": ["Auto"]
+            },
+            {
+                "op": "From COBS",
+                "args": []
+            }
+        ],
+    },
 ]);