Right now, the maximum frame size is hardcoded (https://github.com/1tgr/rust-websocket-lite/blob/master/websocket-codec/src/frame.rs#L53) and extremely high, making maliciously long frames possible, allowing attackers to rapidly use up memory on the receiving side. The same should be possible for the entire message.
Ideally, the user should optionally be able to set a custom limit in bytes to overwrite the defaults.