Thanks very much, happy to hear Mummy might work well for your future stuff.
I will not claim Mummy is DoS-proof by any means, that'd be nuts without extensive evidence to back it up, but I have been mindful in my choices to not leave obvious weak points. To your question about a header limit and similar, yes Mummy has configurable limits for headers, body, and WebSocket message size: <https://nimdocs.com/guzba/mummy/mummy.html#newServer%2CRequestHandler%2CWebSocketHandler%2CLogHandler>
