diff --git a/src/index.ts b/src/index.ts
index 197413e..26bbf63 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -125,7 +125,8 @@ function getDecodedEntity(
                     : parseInt(entity.substr(2));
 
             decodeResult =
-                decodeCode >= 0x10ffff
+                decodeCode >= 0x10ffff ||
+                (decodeCode >= 0xd800 && decodeCode <= 0xdfff)
                     ? outOfBoundsChar
                     : decodeCode > 65535
                     ? fromCodePoint(decodeCode)
diff --git a/test/index.test.ts b/test/index.test.ts
index 37d7311..d6470f7 100644
--- a/test/index.test.ts
+++ b/test/index.test.ts
@@ -143,6 +143,13 @@ describe('lib', () => {
         it('should handle invalid numeric entities', () => {
             expect(decode('&#2013266066;')).toEqual(String.fromCharCode(65533));
         });
+        it('should replace surrogate numeric entities with the replacement character', () => {
+            // Per the WHATWG spec, a numeric character reference to a surrogate
+            // code point (U+D800..U+DFFF) must become U+FFFD, not a lone surrogate.
+            expect(decode('&#xD800;')).toEqual(String.fromCharCode(65533));
+            expect(decode('&#55296;')).toEqual(String.fromCharCode(65533));
+            expect(decode('&#xDFFF;')).toEqual(String.fromCharCode(65533));
+        });
         it('should decode numeric entities without semicolon', () => {
             expect(decode('&#34C&#34')).toEqual('"C"');
         });