AIKIDO-2026-665211

TL;DR

The HTTP server request listener in startHTTPServer parses the incoming request target with new URL(req.url, ...) before authentication and without guarding against parse errors. A request whose target is not a valid URL, such as //, makes the constructor throw ERR_INVALID_URL inside the listener. The unhandled exception propagates out of the listener and terminates the Node.js process, so any client that can reach the proxy can crash it with a single malformed request. The fix wraps the parse in a try/catch and responds with 400 Bad Request instead of crashing.