diff --git a/.github/workflows/check-arduino.yml b/.github/workflows/check-arduino.yml
index 3e0d26c..adb330f 100644
--- a/.github/workflows/check-arduino.yml
+++ b/.github/workflows/check-arduino.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Arduino Lint
         uses: arduino/arduino-lint-action@v1
diff --git a/.github/workflows/compile-examples.yml b/.github/workflows/compile-examples.yml
index fe29687..945a25a 100644
--- a/.github/workflows/compile-examples.yml
+++ b/.github/workflows/compile-examples.yml
@@ -88,7 +88,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Compile examples
         uses: arduino/compile-sketches@v1
diff --git a/.github/workflows/spell-check.yml b/.github/workflows/spell-check.yml
index 6ad2f61..3ce6a08 100644
--- a/.github/workflows/spell-check.yml
+++ b/.github/workflows/spell-check.yml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       # See: https://github.com/codespell-project/actions-codespell/blob/master/README.md
       - name: Spell check
diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml
index 94938f3..9cde1ac 100644
--- a/.github/workflows/sync-labels.yml
+++ b/.github/workflows/sync-labels.yml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Download JSON schema for labels configuration file
         id: download-schema
@@ -105,7 +105,7 @@ jobs:
           echo "::set-output name=flag::--dry-run"
 
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Download configuration files artifact
         uses: actions/download-artifact@v3
diff --git a/docs/api.md b/docs/api.md
index 48e1b3c..76097f3 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -229,7 +229,7 @@ int requestFrom(int id, int type, int address,int nb);
 
 #### Parameters
 - id (slave) - id of target, defaults to 0x00 if not specified
-type - type of read to perform, either COILS, DISCRETE_INPUTS, HOLDING_REGISTERS, or INPUT_REGISTERS
+- type - type of read to perform, either COILS, DISCRETE_INPUTS, HOLDING_REGISTERS, or INPUT_REGISTERS
 - address start address to use for operation
 - nb - number of values to read
 
diff --git a/library.properties b/library.properties
index 4a076b3..84aace6 100644
--- a/library.properties
+++ b/library.properties
@@ -1,5 +1,5 @@
 name=ArduinoModbus
-version=1.0.8
+version=1.0.9
 author=Arduino
 maintainer=Arduino <info@arduino.cc>
 sentence=Use Modbus equipment with your Arduino.
diff --git a/src/libmodbus/modbus.c b/src/libmodbus/modbus.c
index 17e36e1..3afeb3b 100644
--- a/src/libmodbus/modbus.c
+++ b/src/libmodbus/modbus.c
@@ -897,9 +897,10 @@ int modbus_reply(modbus_t *ctx, const uint8_t *req,
         break;
     case MODBUS_FC_WRITE_MULTIPLE_COILS: {
         int nb = (req[offset + 3] << 8) + req[offset + 4];
+        int nb_bits = req[offset + 5];
         int mapping_address = address - mb_mapping->start_bits;
 
-        if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb) {
+        if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb || nb_bits * 8 < nb) {
             /* May be the indication has been truncated on reading because of
              * invalid address (eg. nb is 0 but the request contains values to
              * write) so it's necessary to flush. */
@@ -928,9 +929,10 @@ int modbus_reply(modbus_t *ctx, const uint8_t *req,
         break;
     case MODBUS_FC_WRITE_MULTIPLE_REGISTERS: {
         int nb = (req[offset + 3] << 8) + req[offset + 4];
+        int nb_bytes = req[offset + 5];
         int mapping_address = address - mb_mapping->start_registers;
 
-        if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb) {
+        if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb || nb_bytes * 8 < nb) {
             rsp_length = response_exception(
                 ctx, &sft, MODBUS_EXCEPTION_ILLEGAL_DATA_VALUE, rsp, TRUE,
                 "Illegal number of values %d in write_registers (max %d)\n",
@@ -1017,7 +1019,7 @@ int modbus_reply(modbus_t *ctx, const uint8_t *req,
                 nb_write, nb, MODBUS_MAX_WR_WRITE_REGISTERS, MODBUS_MAX_WR_READ_REGISTERS);
         } else if (mapping_address < 0 ||
                    (mapping_address + nb) > mb_mapping->nb_registers ||
-                   mapping_address < 0 ||
+                   mapping_address_write < 0 ||
                    (mapping_address_write + nb_write) > mb_mapping->nb_registers) {
             rsp_length = response_exception(
                 ctx, &sft, MODBUS_EXCEPTION_ILLEGAL_DATA_ADDRESS, rsp, FALSE,