@@ -586,6 +586,19 @@ class WorkerWrapper : public BaseDataWrapper {
   void Close();
   void Terminate();
 
+  // Arms the near-heap-limit callback on the worker's own isolate. Runs on the
+  // worker thread right after the isolate exists; without it an isolate that
+  // reaches its heap cap aborts the whole process instead of surfacing as an
+  // error on the parent's Worker object. `maxOldGenerationSizeBytes` is only
+  // used to name the cap in the message forwarded to the parent.
+  void WatchHeapLimit(v8::Isolate* isolate, const std::string& scriptPath,
+                      std::optional<size_t> maxOldGenerationSizeBytes);
+  // Whether the heap cap was hit. The worker startup path checks this to stop
+  // before running anything else in an isolate V8 is terminating.
+  inline bool HeapLimitExceeded() const {
+    return heapLimitExceeded_.load(std::memory_order_acquire);
+  }
+
   const WrapperType Type();
   const int Id();
   const inline bool isDisposed() { return isDisposed_; }
@@ -619,6 +632,19 @@ class WorkerWrapper : public BaseDataWrapper {
   // thread) and DestroyInspector() (worker thread) agree on liveness.
   v8_inspector::WorkerInspectorClient* inspector_ = nullptr;
   std::mutex inspectorMutex_;
+  // The worker isolate as seen from the heap-limit callback. Separate from
+  // workerIsolate_, which BackgroundLooper only publishes once the entry script
+  // has finished evaluating — the point at which a heap cap is most likely to
+  // be hit is inside that entry.
+  v8::Isolate* heapLimitIsolate_ = nullptr;
+  std::string heapLimitMessage_;
+  std::string heapLimitSource_;
+  std::atomic<bool> heapLimitExceeded_{false};
+
+  // Runs on the worker thread from inside a GC, where no JS may run and no
+  // handle may be created.
+  static size_t OnNearHeapLimit(void* data, size_t current_heap_limit,
+                                size_t initial_heap_limit);
 
   void BackgroundLooper(std::function<v8::Isolate*()> func);
   void DrainPendingTasks();
 
@@ -805,6 +805,12 @@ static bool GiveWorkerOnErrorAChance(Isolate* isolate, Local<Context> context,
 
 std::string NativeScriptException::GetFullMessage(Isolate* isolate, Local<v8::Message> message,
                                                   const std::string& jsExceptionMessage) {
+  // An isolate V8 has been told to terminate hands back an exception with no
+  // v8::Message at all, and every read below needs a real handle.
+  if (message.IsEmpty()) {
+    return jsExceptionMessage;
+  }
+
   Local<Context> context = isolate->GetEnteredOrMicrotaskContext();
 
   std::stringstream ss;
@@ -821,7 +827,9 @@ static bool GiveWorkerOnErrorAChance(Isolate* isolate, Local<Context> context,
   } else {
     ss << std::endl << "File: (<unknown>";
   }
-  ss << ":" << message->GetLineNumber(context).ToChecked() << ":" << message->GetStartColumn()
+  // FromMaybe, not ToChecked: a location lookup that fails is not worth
+  // aborting the process over.
+  ss << ":" << message->GetLineNumber(context).FromMaybe(0) << ":" << message->GetStartColumn()
      << ")" << std::endl
      << std::endl;
   ss << "StackTrace: " << std::endl << stackTraceMessage << std::endl;
 
@@ -2,6 +2,7 @@
 #define Runtime_h
 
 #include <atomic>
+#include <optional>
 
 #include "Caches.h"
 #include "Common.h"
@@ -17,11 +18,21 @@ typedef struct napi_env__* napi_env;
 
 namespace tns {
 
+// Per-isolate caps handed to Isolate::New. Every entry is optional; an absent
+// one leaves V8's own default in place. Values are bytes.
+struct IsolateLimits {
+  std::optional<size_t> maxOldGenerationSizeBytes;
+  std::optional<size_t> maxYoungGenerationSizeBytes;
+  // Only honored by a V8 build that defines
+  // V8_HAS_JS_DISPATCH_TABLE_RESERVATION_PARAM; ignored otherwise.
+  std::optional<size_t> jsDispatchTableReservationBytes;
+};
+
 class Runtime {
  public:
   Runtime();
   ~Runtime();
-  v8::Isolate* CreateIsolate();
+  v8::Isolate* CreateIsolate(const IsolateLimits& limits = {});
   void Init(v8::Isolate* isolate, bool isWorker = false);
   void RunMainScript();
   v8::Isolate* GetIsolate();
 
@@ -316,7 +316,7 @@ void DisposeIsolateWhenPossible(Isolate* isolate) {
   return static_cast<Runtime*>(isolate->GetData(Constants::RUNTIME_SLOT));
 }
 
-Isolate* Runtime::CreateIsolate() {
+Isolate* Runtime::CreateIsolate(const IsolateLimits& limits) {
   if (!v8Initialized_) {
     // Runtime::platform_ = RuntimeConfig.IsDebug
     //     ? v8_inspector::V8InspectorPlatform::CreateDefaultPlatform()
@@ -345,6 +345,19 @@ void DisposeIsolateWhenPossible(Isolate* isolate) {
 
   Isolate::CreateParams create_params;
   create_params.array_buffer_allocator = &allocator_;
+  if (limits.maxOldGenerationSizeBytes.has_value()) {
+    create_params.constraints.set_max_old_generation_size_in_bytes(
+        *limits.maxOldGenerationSizeBytes);
+  }
+  if (limits.maxYoungGenerationSizeBytes.has_value()) {
+    create_params.constraints.set_max_young_generation_size_in_bytes(
+        *limits.maxYoungGenerationSizeBytes);
+  }
+#ifdef V8_HAS_JS_DISPATCH_TABLE_RESERVATION_PARAM
+  if (limits.jsDispatchTableReservationBytes.has_value()) {
+    create_params.js_dispatch_table_reservation_size = *limits.jsDispatchTableReservationBytes;
+  }
+#endif
   Isolate* isolate = Isolate::New(create_params);
   runtimeLoop_ = CFRunLoopGetCurrent();
   // v8 already asked for this isolate's task runner during Isolate::New, so
 
@@ -1,5 +1,6 @@
 #include "Worker.h"
 #include <pthread.h>
+#include <cmath>
 #include <functional>
 #include <mutex>
 #include <optional>
@@ -48,6 +49,18 @@ bool MapPriorityName(const std::string& name, int& qos) {
   throw NativeScriptException(isolate, error, message);
 }
 
+[[noreturn]] void ThrowOptionRangeError(Isolate* isolate, const std::string& message) {
+  Local<Value> error = Exception::RangeError(tns::ToV8String(isolate, message));
+  throw NativeScriptException(isolate, error, message);
+}
+
+#ifndef V8_HAS_JS_DISPATCH_TABLE_RESERVATION_PARAM
+[[noreturn]] void ThrowOptionError(Isolate* isolate, const std::string& message) {
+  Local<Value> error = Exception::Error(tns::ToV8String(isolate, message));
+  throw NativeScriptException(isolate, error, message);
+}
+#endif
+
 // Returns the quality of service the caller asked for, or nullopt to leave the
 // worker thread at the operation queue's own default.
 std::optional<int> ParseQualityOfService(Isolate* isolate, Local<Context> context,
@@ -96,6 +109,93 @@ bool MapPriorityName(const std::string& name, int& qos) {
   return qos;
 }
 
+// Reads one megabyte-valued `resourceLimits` key. Absent means "leave V8's own
+// default alone"; anything present has to be a finite, positive number, which
+// is where Node draws the line too.
+std::optional<double> ReadMegabyteLimit(Isolate* isolate, Local<Context> context,
+                                        Local<Object> resourceLimits, const char* key) {
+  Local<Value> value;
+  if (!resourceLimits->Get(context, tns::ToV8String(isolate, key)).ToLocal(&value) ||
+      value->IsUndefined()) {
+    return std::nullopt;
+  }
+
+  std::string name = std::string("resourceLimits.") + key;
+  if (!value->IsNumber()) {
+    ThrowOptionTypeError(isolate, "Worker option \"" + name + "\" must be a number.");
+  }
+
+  double megabytes = value.As<Number>()->Value();
+  if (!std::isfinite(megabytes) || megabytes <= 0) {
+    ThrowOptionRangeError(
+        isolate, "Worker option \"" + name + "\" must be a finite number greater than zero.");
+  }
+
+  return megabytes;
+}
+
+// The JS dispatch table is reserved as one contiguous range at isolate
+// creation, so V8 only accepts whole megabytes up to its own hard ceiling.
+constexpr double kMaxJsDispatchTableSizeMb = 256;
+
+#ifdef V8_HAS_JS_DISPATCH_TABLE_RESERVATION_PARAM
+// iOS caps a process's address space by device RAM, and every isolate reserves
+// 256 MB for its JS dispatch table by default; 64 MB still holds four million
+// dispatch entries, far more than a worker allocates. Only workers get the
+// smaller reservation — the main isolate keeps V8's default.
+constexpr size_t kDefaultWorkerJsDispatchTableBytes = 64 * 1024 * 1024;
+#endif
+
+// Node's `resourceLimits` shape. Unknown keys are ignored, so the options Node
+// has and this runtime cannot honor (codeRangeSizeMb, stackSizeMb) stay
+// harmless to pass.
+IsolateLimits ParseResourceLimits(Isolate* isolate, Local<Context> context, Local<Object> options) {
+  IsolateLimits limits;
+
+  Local<Value> value;
+  if (!options->Get(context, tns::ToV8String(isolate, "resourceLimits")).ToLocal(&value) ||
+      value->IsNullOrUndefined()) {
+    return limits;
+  }
+
+  if (!value->IsObject()) {
+    ThrowOptionTypeError(isolate, "Worker option \"resourceLimits\" must be an object.");
+  }
+  Local<Object> resourceLimits = value.As<Object>();
+
+  constexpr double kBytesPerMegabyte = 1024 * 1024;
+
+  if (auto megabytes =
+          ReadMegabyteLimit(isolate, context, resourceLimits, "maxOldGenerationSizeMb")) {
+    limits.maxOldGenerationSizeBytes = static_cast<size_t>(*megabytes * kBytesPerMegabyte);
+  }
+
+  if (auto megabytes =
+          ReadMegabyteLimit(isolate, context, resourceLimits, "maxYoungGenerationSizeMb")) {
+    limits.maxYoungGenerationSizeBytes = static_cast<size_t>(*megabytes * kBytesPerMegabyte);
+  }
+
+  if (auto megabytes =
+          ReadMegabyteLimit(isolate, context, resourceLimits, "jsDispatchTableSizeMb")) {
+    if (*megabytes != std::floor(*megabytes) || *megabytes < 1 ||
+        *megabytes > kMaxJsDispatchTableSizeMb) {
+      ThrowOptionRangeError(isolate,
+                            "Worker option \"resourceLimits.jsDispatchTableSizeMb\" must be a "
+                            "whole number of megabytes between 1 and 256.");
+    }
+#ifdef V8_HAS_JS_DISPATCH_TABLE_RESERVATION_PARAM
+    limits.jsDispatchTableReservationBytes =
+        static_cast<size_t>(*megabytes) * static_cast<size_t>(kBytesPerMegabyte);
+#else
+    ThrowOptionError(isolate,
+                     "Worker option \"resourceLimits.jsDispatchTableSizeMb\" requires a V8 build "
+                     "with a configurable JS dispatch table.");
+#endif
+  }
+
+  return limits;
+}
+
 }  // namespace
 
 void Worker::Init(Isolate* isolate, Local<ObjectTemplate> globalTemplate) {
@@ -230,10 +330,19 @@ throw NativeScriptException(
     }
 
     std::optional<int> qos;
+    IsolateLimits resourceLimits;
     if (info.Length() >= 2 && info[1]->IsObject()) {
-      qos = ParseQualityOfService(isolate, context, info[1].As<Object>());
+      Local<Object> options = info[1].As<Object>();
+      qos = ParseQualityOfService(isolate, context, options);
+      resourceLimits = ParseResourceLimits(isolate, context, options);
     }
 
+#ifdef V8_HAS_JS_DISPATCH_TABLE_RESERVATION_PARAM
+    if (!resourceLimits.jsDispatchTableReservationBytes.has_value()) {
+      resourceLimits.jsDispatchTableReservationBytes = kDefaultWorkerJsDispatchTableBytes;
+    }
+#endif
+
     WorkerWrapper* worker = new WorkerWrapper(isolate, Worker::OnMessageCallback);
     tns::SetValue(isolate, thiz, worker);
     std::shared_ptr<Persistent<Value>> poWorker = ObjectManager::Register(context, thiz);
@@ -246,7 +355,7 @@ throw NativeScriptException(
     // vocabulary updates).
     tns::LoaderVocabulary inheritedVocabulary = tns::CaptureLoaderVocabulary(isolate);
 
-    std::function<Isolate*()> func([worker, workerPath, inheritedVocabulary]() {
+    std::function<Isolate*()> func([worker, workerPath, inheritedVocabulary, resourceLimits]() {
       // Name the looper thread after its entry script so a crash report
       // identifies which worker died instead of an anonymous NSOperationQueue
       // thread. Darwin caps thread names at 63 bytes; keep the basename only.
@@ -273,8 +382,11 @@ throw NativeScriptException(
       }
 
       tns::Runtime* runtime = new tns::Runtime();
-      Isolate* isolate = runtime->CreateIsolate();
+      Isolate* isolate = runtime->CreateIsolate(resourceLimits);
       v8::Locker locker(isolate);
+      // Armed for every worker isolate, capped or not: without it V8 aborts the
+      // whole process when a worker exhausts its heap.
+      worker->WatchHeapLimit(isolate, resolvedPath, resourceLimits.maxOldGenerationSizeBytes);
       runtime->Init(isolate, true);
       // Before any module load runs in this isolate.
       tns::InstallLoaderVocabulary(isolate, inheritedVocabulary);
@@ -313,6 +425,12 @@ throw NativeScriptException(
         ex.ReThrowToV8(isolate);
       }
 
+      // The near-heap-limit callback has already reported to the parent and
+      // asked V8 to terminate this isolate; everything below would run JS on it.
+      if (worker->HeapLimitExceeded()) {
+        return isolate;
+      }
+
       // WHATWG parity: enable the implicit port's message queue once the
       // entry has finished evaluating. RunModule returns settled for classic
       // scripts and pumped HTTP entries; a local top-level-await entry that
 
@@ -165,6 +165,15 @@ static void PostToRuntimeLoop(Runtime* runtime, std::function<void()> fn, bool a
   // is deleted below.
   this->DestroyInspector();
 
+  // The callback closes over this wrapper, which ~Runtime may delete below,
+  // while V8 keeps the registration until the isolate is disposed - and
+  // disposal can be deferred past that point.
+  if (this->heapLimitIsolate_ != nullptr) {
+    v8::Locker locker(this->heapLimitIsolate_);
+    this->heapLimitIsolate_->RemoveNearHeapLimitCallback(WorkerWrapper::OnNearHeapLimit, 0);
+    this->heapLimitIsolate_ = nullptr;
+  }
+
   this->isDisposed_ = true;
   Runtime* runtime = Runtime::GetCurrentRuntime();
   if (runtime != nullptr) {
@@ -221,6 +230,52 @@ static void PostToRuntimeLoop(Runtime* runtime, std::function<void()> fn, bool a
   }
 }
 
+void WorkerWrapper::WatchHeapLimit(Isolate* isolate, const std::string& scriptPath,
+                                   std::optional<size_t> maxOldGenerationSizeBytes) {
+  this->heapLimitIsolate_ = isolate;
+  this->heapLimitSource_ = scriptPath.empty() ? "Worker" : scriptPath;
+  this->heapLimitMessage_ = "Worker JS heap out of memory";
+  if (maxOldGenerationSizeBytes.has_value()) {
+    this->heapLimitMessage_ +=
+        " (maxOldGenerationSizeMb: " + std::to_string(*maxOldGenerationSizeBytes / (1024 * 1024)) +
+        ")";
+  }
+  isolate->AddNearHeapLimitCallback(WorkerWrapper::OnNearHeapLimit, this);
+}
+
+size_t WorkerWrapper::OnNearHeapLimit(void* data, size_t current_heap_limit,
+                                      size_t initial_heap_limit) {
+  auto* worker = static_cast<WorkerWrapper*>(data);
+
+  // Node's allowance: raising the limit lets the in-progress GC finish instead
+  // of aborting the process, and the isolate is being torn down anyway. The
+  // same raised limit has to come back on every later invocation, because
+  // returning a lower one is fatal to V8.
+  constexpr size_t kHeapLimitAllowance = 16 * 1024 * 1024;
+  size_t raisedLimit = current_heap_limit + kHeapLimitAllowance;
+
+  if (worker->heapLimitExceeded_.exchange(true, std::memory_order_acq_rel)) {
+    return raisedLimit;
+  }
+
+  // Marshals strings onto the parent's loop and touches no V8 handle, which is
+  // the only kind of reporting allowed from inside a GC.
+  worker->PassUncaughtExceptionFromWorkerToMain(worker->heapLimitMessage_, worker->heapLimitSource_,
+                                                "", 0, true);
+
+  // Terminate() only reaches an isolate BackgroundLooper has already published,
+  // which happens after the entry script finished evaluating — and a worker
+  // that exhausts its heap usually does so inside that entry. Ask the isolate
+  // this callback belongs to directly.
+  if (Runtime* runtime = Runtime::GetRuntime(worker->heapLimitIsolate_)) {
+    runtime->RequestTermination();
+  }
+  worker->heapLimitIsolate_->TerminateExecution();
+  worker->Terminate();
+
+  return raisedLimit;
+}
+
 void WorkerWrapper::CreateInspector(Isolate* isolate, const std::string& scriptPath) {
   if (!RuntimeConfig.IsDebug) {
     return;