diff --git a/tests/e2e/static-repository-assets.spec.js b/tests/e2e/static-repository-assets.spec.js
index efa5719..bc91b29 100644
--- a/tests/e2e/static-repository-assets.spec.js
+++ b/tests/e2e/static-repository-assets.spec.js
@@ -32,4 +32,12 @@ test.describe("Unmodified repository static assets", () => {
     const missing = await request.get(`${staticRepositoryUrl}/does-not-exist`);
     expect(missing.status()).toBe(404);
   });
+
+  test("returns 400 for malformed percent-encoded paths without stopping the server", async ({ request }) => {
+    const malformed = await request.get(`${staticRepositoryUrl}/%E0%A4%A`);
+    expect(malformed.status()).toBe(400);
+
+    const followingRequest = await request.get(`${staticRepositoryUrl}/settings.json`);
+    expect(followingRequest.status()).toBe(200);
+  });
 });
diff --git a/tests/e2e/static-server.js b/tests/e2e/static-server.js
index f6e0d8e..5a09774 100644
--- a/tests/e2e/static-server.js
+++ b/tests/e2e/static-server.js
@@ -22,9 +22,18 @@ http
       return;
     }
 
-    const url = new URL(request.url, "http://127.0.0.1");
-    const pathname = url.pathname === "/" ? "/index.html" : url.pathname;
-    const file = path.resolve(root, `.${decodeURIComponent(pathname)}`);
+    let pathname;
+    try {
+      const url = new URL(request.url, "http://127.0.0.1");
+      pathname = url.pathname === "/" ? "/index.html" : url.pathname;
+      pathname = decodeURIComponent(pathname);
+    } catch {
+      response.writeHead(400);
+      response.end();
+      return;
+    }
+
+    const file = path.resolve(root, `.${pathname}`);
 
     if (!file.startsWith(`${root}${path.sep}`)) {
       response.writeHead(403);