patch nesting depth issue

[farhanfarasdak]

There is no limit on nesting depth anywhere in the decode path. A grep for depth/nesting/10000 in the package matches only the encoder's pointer-cycle counter and the streaming tokenizer — nothing guards decode recursion. The standard library it replaces deliberately caps this at maxNestingDepth = 10000 and returns an error

Case like this possible :
An attacker sends a tiny, highly-repetitive body — e.g. ~5,000,000 [ characters followed by ] (about 10 MB, trivially gzip-compressible to a few KB over the wire). Decoding it drives ~5,000,000 nested calls and pushes the goroutine stack past Go's hard limit (1 GiB), producing fatal error: stack overflow / runtime: goroutine stack exceeds 1000000000-byte limit. Crucially this is not a recoverable panic: a Go stack overflow is a fatal runtime error that recover() cannot intercept (and the package has no recover() anyway), so the entire process dies — not just the request goroutine.