You&#x27;re overdoing it a bit. I believe the most popular API&#x2F;library for server-side manipulation of images is ImageMagick, and it has a few options for specifying limits that will easily protect against decompression bombs.<p>That being said, even with these limits, it&#x27;s undeniable that something like ImageMagick still has a very large attack surface (especially since it uses many third-party libraries), so it should run in its own heavily unprivileged or sandboxed process.