diff --git a/playground/20-12-02-wasm-ffmpeg/server.js b/playground/20-12-02-wasm-ffmpeg/server.js
index 51eda5e..06c0c30 100644
--- a/playground/20-12-02-wasm-ffmpeg/server.js
+++ b/playground/20-12-02-wasm-ffmpeg/server.js
@@ -15,6 +15,11 @@ const mimeTypes = {
 };
 
 http.createServer({}, (request, response) => {
+    if (path.normalize(decodeURI(request.url)) !== decodeURI(request.url)) {
+        response.statusCode = 403;
+        response.end();
+        return;
+    }
   const uri = url.parse(request.url).pathname;
   let filename = path.join(process.cwd(), uri);