diff --git a/docker-server.mjs b/docker-server.mjs
index bcc1c8636..87b53c7d1 100644
--- a/docker-server.mjs
+++ b/docker-server.mjs
@@ -21,6 +21,7 @@ const contentTypes = {
 };
 
 function resolvePath(urlPath) {
+  if (urlPath.includes('\0')) return null;
   const cleanPath = normalize(decodeURIComponent(urlPath).replace(/^\/+/, ''));
   const candidate = join(root, cleanPath);
   if (!candidate.startsWith(root)) return null;