diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 94208ae..e7ed905 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -6,10 +6,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v1
-      - name: Setup Environment (Using NodeJS 22.x)
+      - name: Setup Environment (Using NodeJS 24.x)
         uses: actions/setup-node@v1
         with:
-          node-version: 22.x
+          node-version: 24.x
 
       - name: Install dependencies
         run: npm install
diff --git a/README.md b/README.md
index 175b5cc..2b47582 100644
--- a/README.md
+++ b/README.md
@@ -20,6 +20,7 @@ Read more online:
 ```js
 npm i fast-gateway
 ```
+> Requires Node.js 24 or newer. Upgrading from v5.x? See the [breaking changes](https://fgw.21no.de/#/?id=v6x).
 
 ## Usage 
 ### Gateway
diff --git a/docs/README.md b/docs/README.md
index b78cbc4..d0753f6 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -25,6 +25,8 @@ Read more online:
 npm i fast-gateway
 ```
 
+> Requires Node.js 24 or newer. Upgrading from v5.x? See the v6.x Breaking Changes below.
+
 # Usage
 
 Next we describe two examples proxying HTTP and Lambda downstream services.
@@ -120,6 +122,7 @@ module.exports.handler = serverless(service)
   server,
   // Optional restana library configuration (https://www.npmjs.com/package/restana#configuration)
   // Please note that if "server" is provided, this settings are ignored.
+  // Routes are matched case-sensitively, use { caseSensitive: false } to match them case-insensitively.
   restana: {},
   // Optional global middlewares in the format: (req, res, next) => next()
   // Default value: []
@@ -175,7 +178,7 @@ module.exports.handler = serverless(service)
       endpoint: '/api-docs',
       type: 'swagger'
     },
-    // Optional "prefix rewrite" before request is forwarded. Default value: ''
+    // Optional "prefix rewrite" before request is forwarded, used literally. Default value: ''
     prefixRewrite: '',
     // Optional "url rewrite" hook. If defined, the prefixRewrite setting is ignored.
     urlRewrite: (req) => req.url,
@@ -541,6 +544,40 @@ You can support the maintenance of this project:
 
 # Breaking Changes
 
+## v6.x
+
+**Runtime**
+
+- Node.js 24 or newer is required.
+- [restana 7](https://github.com/BackendStack21/restana/blob/master/MIGRATION.md) is the default HTTP framework. Its trie router matches paths **case-sensitively**: `GET /Users` no longer matches a route with `prefix: '/users'`. Set `restana: { caseSensitive: false }` to keep the previous behavior.
+- Errors handled by restana's default `errorHandler` respond with the standard status text, e.g. `{"code":404,"message":"Not Found"}` instead of `"Internal Server Error"`.
+
+**Routing**
+
+- Requests whose path contains `.` or `..` segments get a `400` response. This includes encoded (`%2e`, `%2f`, `%5c`), backslash and `;` parameter forms such as `/..;/`.
+- The prefix is only stripped from the start of the URL.
+- `prefixRewrite` is used literally, so `$&` and other replacement patterns are no longer expanded.
+- `prefix: '/'` works as a catch-all route, and prefixes ending in `/` match nested paths. A `prefixRewrite` ending in `/` no longer produces `//`.
+
+**Proxying**
+
+- Chunked `Connection: close` responses over 1MB are streamed instead of rejected with `502`.
+- A route's `timeout: 0` disables the global timeout. `hooks.request` is merged with the timeout instead of replacing it, and `req.timeout` takes precedence over `hooks.request.timeout`.
+- Repeated query parameters (`?a=1&a=2`) are forwarded as-is. No trailing `?` is appended when there is no query string, and `proxyOpts.queryString` is then `null`.
+- The routes and hooks passed to `gateway()` are no longer modified, so they can be shared between routes and gateways.
+- If `onError` sends a response, `next(err)` is skipped. A response already partly sent when the error happened is destroyed.
+
+**Hostnames hook**
+
+- Hostnames are matched case-insensitively. Matchers are compiled when the hook is created, so later changes to the `hostname2prefix` array are not picked up.
+
+**WebSockets**
+
+- Close codes and reasons are relayed in both directions. When the upstream closes with a code that can't be relayed (1001, 1006, 1011), the client connection is dropped.
+- Only the subprotocol agreed with the client is offered upstream, and the query string is forwarded unchanged.
+- Messages sent while an async `onOpen` hook runs are queued and forwarded. Past 1MB of queued data, the client is closed with code `4413`.
+- Upgrade requests that aren't WebSocket, or match no route, are ended.
+
 ## v3.x
 
 - The `fast-proxy-lite` module is used by default to support `http` proxy type 🔥. This means, no `undici` or `http2` are supported by default.
diff --git a/docs/index.html b/docs/index.html
index 023142b..5333a61 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -7,7 +7,7 @@
   <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />
   <meta name="description" content="A super fast, framework agnostic, Node.js API Gateway for the masses!">
   <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0">
-  <link rel="stylesheet" href="//cdn.jsdelivr.net/npm/docsify@4/lib/themes/vue.css">
+  <link rel="stylesheet" href="//cdn.jsdelivr.net/npm/docsify@4.13.1/lib/themes/vue.css">
   <link href="https://fonts.googleapis.com/css?family=Outfit" rel="stylesheet">
 
   <style>
@@ -36,10 +36,10 @@
     }
   </script>
   <!-- Docsify v4 -->
-  <script src="//cdn.jsdelivr.net/npm/docsify@4"></script>
+  <script src="//cdn.jsdelivr.net/npm/docsify@4.13.1"></script>
 
-  <script src="https://unpkg.com/docsify-copy-code@2"></script>
-  <script src="https://unpkg.com/docsify-share/build/index.min.js"></script>.
+  <script src="https://unpkg.com/docsify-copy-code@2.1.1"></script>
+  <script src="https://unpkg.com/docsify-share@0.1.3/build/index.min.js"></script>
 
   <script type="text/javascript" charset="UTF-8"
     src="//cdn.cookie-script.com/s/28dc51cd1b79414f499d222fffd2095d.js"></script>
diff --git a/index.js b/index.js
index 4617366..9bc8a7c 100644
--- a/index.js
+++ b/index.js
@@ -6,12 +6,16 @@ const defaultProxyFactory = require('./lib/proxy-factory')
 const restana = require('restana')
 const defaultProxyHandler = (req, res, url, proxy, proxyOpts) =>
   proxy(req, res, url, proxyOpts)
-const DEFAULT_METHODS = require('restana/libs/methods').BASE.filter(
-  (method) => method !== 'all'
-)
+// restana's base HTTP methods, without "all"
+const DEFAULT_METHODS = ['get', 'delete', 'patch', 'post', 'put', 'head', 'options']
 const NOOP = (req, res) => {}
-const PROXY_TYPES = ['http', 'lambda']
+const PROXY_TYPES = ['http', 'http-legacy', 'lambda']
 const registerWebSocketRoutes = require('./lib/ws-proxy')
+// "." and ".." path segments, also percent-encoded or separated by a backslash
+// or an encoded (back)slash, some upstreams decode those before normalizing
+// (a ";" path parameter is ignored by some upstreams, e.g. "/..;/")
+const DOT_SEGMENT_REGEX =
+  /(?:^|[/\\]|%2f|%5c)(?:\.|%2e){1,2}(?:;[^/\\]*)?(?:[/\\]|%2f|%5c|$)/i
 
 const gateway = (opts) => {
   let proxyFactory
@@ -43,7 +47,8 @@ const gateway = (opts) => {
 
   // registering services.json
   const services = opts.routes.map((route) => ({
-    prefix: route.prefix,
+    prefix:
+      route.prefix instanceof RegExp ? route.prefix.toString() : route.prefix,
     docs: route.docs
   }))
   if (opts.enableServicesEndpoint) {
@@ -74,7 +79,10 @@ const gateway = (opts) => {
   // processing non-websocket routes
   opts.routes
     .filter((route) => route.proxyType !== 'websocket')
-    .forEach((route) => {
+    .forEach((routeConfig) => {
+      // route configs can be shared between routes or gateways, don't mutate them
+      const route = Object.assign({}, routeConfig)
+
       if (undefined === route.prefixRewrite) {
         route.prefixRewrite = ''
       }
@@ -95,9 +103,11 @@ const gateway = (opts) => {
       const { onRequestNoOp = NOOP, onResponse = NOOP } = hooksForDefaultType
 
       // populating required NOOPS
-      route.hooks = route.hooks || {}
-      route.hooks.onRequest = route.hooks.onRequest || onRequestNoOp
-      route.hooks.onResponse = route.hooks.onResponse || onResponse
+      const hooks = route.hooks || {}
+      route.hooks = Object.assign({}, hooks, {
+        onRequest: hooks.onRequest || onRequestNoOp,
+        onResponse: hooks.onResponse || onResponse
+      })
 
       // populating route middlewares
       route.middlewares = route.middlewares || []
@@ -112,21 +122,30 @@ const gateway = (opts) => {
       // route proxy handler function
       const proxyHandler = route.proxyHandler || defaultProxyHandler
 
-      // populating timeout config
-      route.timeout = route.timeout || opts.timeout
+      // populating timeout config, 0 disables the timeout
+      route.timeout = route.timeout ?? opts.timeout
+
+      // avoid a double slash between prefix and pathRegex, e.g. prefix: '/'
+      let prefix = route.prefix
+      if (
+        typeof prefix === 'string' &&
+        prefix.endsWith('/') &&
+        typeof route.pathRegex === 'string' &&
+        route.pathRegex.startsWith('/')
+      ) {
+        prefix = prefix.slice(0, -1)
+      }
 
       // registering route handlers
       const methods = route.methods || DEFAULT_METHODS
 
       const args = [
         // path
-        route.prefix instanceof RegExp
-          ? route.prefix
-          : route.prefix + route.pathRegex,
+        prefix instanceof RegExp ? prefix : prefix + route.pathRegex,
         // route middlewares
         ...route.middlewares,
         // route handler
-        handler(route, proxy, proxyHandler)
+        handler(route, prefix, proxy, proxyHandler)
       ]
 
       methods.forEach((method) => {
@@ -140,10 +159,56 @@ const gateway = (opts) => {
   return router
 }
 
-const handler = (route, proxy, proxyHandler) => async (req, res, next) => {
+const hasDotSegment = (url) => {
+  const queryIndex = url.indexOf('?')
+
+  return DOT_SEGMENT_REGEX.test(
+    queryIndex === -1 ? url : url.slice(0, queryIndex)
+  )
+}
+
+// routes can be matched case-insensitively (e.g. restana's caseSensitive: false),
+// so the prefix is stripped the same way
+const stripPrefix = (url, prefix, prefixRewrite) => {
+  if (url.slice(0, prefix.length).toLowerCase() !== prefix.toLowerCase()) {
+    return url
+  }
+
+  // avoid a double slash when prefixRewrite ends with "/", e.g. '/api/'
+  const rest = url.slice(prefix.length)
+
+  return prefixRewrite.endsWith('/') && rest.startsWith('/')
+    ? prefixRewrite + rest.slice(1)
+    : prefixRewrite + rest
+}
+
+// URLSearchParams(object) joins repeated parameters (arrays) with commas,
+// iterating [name, value] pairs makes it append each value instead
+function * queryPairs () {
+  for (const name in this) {
+    for (const value of [].concat(this[name])) yield [name, value]
+  }
+}
+
+const toQueryString = (query, url) => {
+  if (!query) return query
+
+  const values = Object.values(query)
+  // nothing to forward, avoids a trailing "?" in the upstream url
+  if (values.length === 0 && !url.includes('?')) return null
+  if (!values.some(Array.isArray)) return query
+
+  // still a plain object for hooks and custom proxy handlers
+  return Object.defineProperty(
+    Object.assign(Object.create(null), query),
+    Symbol.iterator,
+    { value: queryPairs }
+  )
+}
+
+const handler = (route, prefix, proxy, proxyHandler) => async (req, res, next) => {
   const {
     urlRewrite,
-    prefix,
     prefixRewrite,
     hooks,
     timeout,
@@ -152,27 +217,45 @@ const handler = (route, proxy, proxyHandler) => async (req, res, next) => {
   const { onRequest } = hooks
 
   try {
+    // the upstream would resolve dot segments, escaping the route prefix
+    if (hasDotSegment(req.url)) {
+      res.statusCode = 400
+      res.end('Bad Request')
+
+      return
+    }
+
     if (typeof urlRewrite === 'function') {
       req.url = urlRewrite(req)
     } else if (typeof prefix === 'string') {
-      req.url = req.url.replace(prefix, prefixRewrite)
+      req.url = stripPrefix(req.url, prefix, prefixRewrite)
+    }
+
+    // restana shares a frozen empty req.query when there is no query string
+    if (req.query && Object.isFrozen(req.query)) {
+      req.query = Object.create(null)
     }
 
     const shouldAbortProxy = await onRequest(req, res)
     if (!shouldAbortProxy) {
       const proxyOpts = Object.assign(
         {
-          request: {
-            timeout: req.timeout || timeout
-          },
-          queryString: disableQsOverwrite ? null : req.query
+          queryString: disableQsOverwrite
+            ? null
+            : toQueryString(req.query, req.url)
         },
-        route.hooks
+        hooks,
+        {
+          request: Object.assign({}, hooks.request, {
+            timeout: req.timeout ?? hooks.request?.timeout ?? timeout
+          })
+        }
       )
 
-      proxyHandler(req, res, req.url, proxy, proxyOpts)
+      await proxyHandler(req, res, req.url, proxy, proxyOpts)
     }
   } catch (err) {
+    const headersSent = res.headersSent
     const { onError } = hooks
     if (typeof onError === 'function') {
       try {
@@ -182,7 +265,13 @@ const handler = (route, proxy, proxyHandler) => async (req, res, next) => {
       }
     }
 
-    return next(err)
+    if (headersSent) {
+      // a partially sent response can't be turned into an error response
+      if (!res.writableEnded) res.destroy()
+    } else if (!res.headersSent) {
+      // otherwise the onError hook already sent a response
+      return next(err)
+    }
   }
 }
 
diff --git a/lib/default-hooks.js b/lib/default-hooks.js
index d3c45d3..f776ba2 100644
--- a/lib/default-hooks.js
+++ b/lib/default-hooks.js
@@ -4,9 +4,65 @@ const pump = require('pump')
 const TRANSFER_ENCODING_HEADER_NAME = 'transfer-encoding'
 
 // Maximum size in bytes for buffered chunked responses (Connection: close)
-// Prevents memory exhaustion from unbounded upstream response bodies
+// Larger upstream response bodies are streamed instead, preventing memory exhaustion
 const MAX_BUFFER_SIZE = 1 * 1024 * 1024 // 1MB
 
+const bufferResponse = (res, stream) =>
+  new Promise((resolve) => {
+    const chunks = []
+    let totalSize = 0
+
+    const cleanup = () => {
+      stream.removeListener('data', onData)
+      stream.removeListener('end', onEnd)
+      stream.removeListener('error', onError)
+      res.removeListener('close', onClose)
+    }
+
+    const onData = (chunk) => {
+      totalSize += chunk.length
+      chunks.push(chunk)
+      if (totalSize > MAX_BUFFER_SIZE) {
+        // too large to be buffered, flush what we have and stream the rest
+        stream.pause()
+        cleanup()
+        chunks.forEach((chunk) => res.write(chunk))
+        pump(stream, res, () => resolve())
+      }
+    }
+
+    const onEnd = () => {
+      cleanup()
+      const resBuffer = Buffer.concat(chunks)
+
+      // add content-length header and send the merged response buffer
+      res.setHeader('content-length', '' + Buffer.byteLength(resBuffer))
+      res.end(resBuffer)
+      resolve()
+    }
+
+    const onError = (err) => {
+      cleanup()
+      // upstream headers (e.g. content-encoding) don't describe the error body
+      Object.keys(stream.headers).forEach((name) => res.removeHeader(name))
+      res.statusCode = 500
+      res.end(err.message)
+      resolve()
+    }
+
+    const onClose = () => {
+      // the client went away before the response was sent, release the upstream
+      cleanup()
+      stream.destroy()
+      resolve()
+    }
+
+    stream.on('data', onData)
+    stream.on('end', onEnd)
+    stream.on('error', onError)
+    res.on('close', onClose)
+  })
+
 module.exports = {
   websocket: {
     onOpenNoOp (ws, searchParams) {}
@@ -14,10 +70,20 @@ module.exports = {
   lambda: {
     onRequestNoOp (req, res) {},
     onResponse (req, res, response) {
-      const { statusCode, body } = JSON.parse(response.Payload)
+      const {
+        statusCode = response.StatusCode || 200,
+        body,
+        isBase64Encoded
+      } = JSON.parse(response.Payload) || {}
 
       res.statusCode = statusCode
-      res.end(body)
+      if (body === undefined || body === null) {
+        res.end()
+      } else if (isBase64Encoded) {
+        res.end(Buffer.from(body, 'base64'))
+      } else {
+        res.end(typeof body === 'string' ? body : JSON.stringify(body))
+      }
     }
   },
   http: {
@@ -28,48 +94,18 @@ module.exports = {
         : false
 
       if (req.headers.connection === 'close' && chunked) {
-        try {
-          // remove transfer-encoding header
-          const transferEncoding = stream.headers[
-            TRANSFER_ENCODING_HEADER_NAME
-          ].replace(/(,( )?)?chunked/, '')
-          if (transferEncoding) {
-            // header format includes many encodings, example: gzip, chunked
-            res.setHeader(TRANSFER_ENCODING_HEADER_NAME, transferEncoding)
-          } else {
-            res.removeHeader(TRANSFER_ENCODING_HEADER_NAME)
-          }
-
-          if (!stream.headers['content-length']) {
-            // Collect chunks with size limit to prevent OOM
-            const chunks = []
-            let totalSize = 0
-
-            for await (const chunk of stream) {
-              totalSize += chunk.length
-              if (totalSize > MAX_BUFFER_SIZE) {
-                stream.destroy()
-                res.statusCode = 502
-                res.end('Response body exceeds maximum allowed size')
-                return
-              }
-              chunks.push(chunk)
-            }
-
-            const resBuffer = Buffer.concat(chunks)
-
-            // add content-length header and send the merged response buffer
-            res.setHeader('content-length', '' + Buffer.byteLength(resBuffer))
-            res.end(resBuffer)
-          }
-        } catch (err) {
-          res.statusCode = 500
-          res.end(err.message)
-        }
-      } else {
-        res.statusCode = stream.statusCode
-        pump(stream, res)
+        // the buffered response is sent with a content-length instead,
+        // a transfer-encoding can't be combined with it
+        res.removeHeader(TRANSFER_ENCODING_HEADER_NAME)
+
+        return bufferResponse(res, stream)
       }
+
+      res.statusCode = stream.statusCode
+      pump(stream, res)
     }
   }
 }
+
+// fast-proxy (http-legacy) responses are handled as fast-proxy-lite ones
+module.exports['http-legacy'] = module.exports.http
diff --git a/lib/hostnames-hook.js b/lib/hostnames-hook.js
index 15b5030..5375cc9 100644
--- a/lib/hostnames-hook.js
+++ b/lib/hostnames-hook.js
@@ -1,37 +1,22 @@
 'use strict'
 
-let micromatch
-try {
-  micromatch = require('micromatch')
-} catch (e) {
-  micromatch = {
-    isMatch (value, pattern) {
-      return value === pattern
-    }
-  }
-}
+const micromatch = require('micromatch')
 
 module.exports = (hostname2prefix) => {
-  const matches = {}
+  // matchers are compiled once, caching results per host would grow without bound
+  const matchers = hostname2prefix.map((e) => ({
+    isMatch: micromatch.matcher(e.hostname, { nocase: true }),
+    prefix: e.prefix
+  }))
 
   return (req, res, cb) => {
     if (req.headers.host) {
-      const hostHeader = req.headers.host.split(':')[0]
-      let prefix = matches[hostHeader]
-
-      if (!prefix) {
-        for (const e of hostname2prefix) {
-          if (micromatch.isMatch(hostHeader, e.hostname)) {
-            prefix = e.prefix
-            matches[hostHeader] = prefix
-
-            break
-          }
-        }
-      }
+      // host names are case-insensitive
+      const hostHeader = req.headers.host.split(':')[0].toLowerCase()
+      const match = matchers.find((e) => e.isMatch(hostHeader))
 
-      if (prefix) {
-        req.url = prefix + req.url
+      if (match && match.prefix) {
+        req.url = match.prefix + req.url
       }
     }
 
diff --git a/lib/ws-proxy.js b/lib/ws-proxy.js
index c441577..42d4652 100644
--- a/lib/ws-proxy.js
+++ b/lib/ws-proxy.js
@@ -3,47 +3,138 @@
 const micromatch = require('micromatch')
 const { onOpenNoOp } = require('./default-hooks').websocket
 
+const CONNECTING = 0
+const OPEN = 1
+const MAX_CLOSE_REASON_BYTES = 123
+// maximum size of the messages queued while the onOpen hook is pending
+const MAX_PENDING_BYTES = 1 * 1024 * 1024 // 1MB
+// time other 'upgrade' listeners get to handle a socket before it is ended
+const UNHANDLED_UPGRADE_TIMEOUT = 1000
+
+// faye-websocket only accepts 1000 or 3000-4999 as close codes
+const toCloseCode = (code, fallback) =>
+  Number.isInteger(code) && (code === 1000 || (code >= 3000 && code <= 4999))
+    ? code
+    : fallback
+
+const toCloseReason = (reason) => {
+  if (typeof reason !== 'string') return ''
+
+  const buffer = Buffer.from(reason)
+  if (buffer.length <= MAX_CLOSE_REASON_BYTES) return reason
+
+  // don't cut a multi-byte UTF-8 character in half
+  let end = MAX_CLOSE_REASON_BYTES
+  while (end > 0 && (buffer[end] & 0xc0) === 0x80) end--
+
+  return buffer.toString('utf8', 0, end)
+}
+
+const close = (ws, code, reason) => {
+  if (ws.readyState === CONNECTING || ws.readyState === OPEN) {
+    ws.close(code, toCloseReason(reason))
+  }
+}
+
+// resolves once the opening handshake has either completed or failed
+const handshake = (ws) =>
+  new Promise((resolve) => {
+    if (ws.readyState !== CONNECTING) return resolve()
+    ws.once('open', resolve)
+    ws.once('close', resolve)
+  })
+
+// onAbnormalClose is called when the close code can't be relayed
+const relay = (from, to, onAbnormalClose) => {
+  from.on('message', (event) => to.send(event.data))
+  from.on('close', (event) => {
+    const code = toCloseCode(event.code)
+    if (code === undefined) return onAbnormalClose()
+
+    close(to, code, event.reason)
+  })
+}
+
 module.exports = (config) => {
   const WebSocket = require('faye-websocket')
 
   const { routes, server } = config
 
-  routes.forEach((route) => {
-    route._isMatch = micromatch.matcher(route.prefix)
-  })
+  const matchers = routes.map((route) => ({
+    route,
+    isMatch: micromatch.matcher(route.prefix)
+  }))
 
-  server.on('upgrade', async (req, socket, body) => {
-    if (WebSocket.isWebSocket(req)) {
-      const url = new URL('http://fw' + req.url)
-      const prefix = url.pathname || '/'
-
-      const route = routes.find((route) => route._isMatch(prefix))
-      if (route) {
-        const subProtocols = route.subProtocols || []
-        route.hooks = route.hooks || {}
-        const onOpen = route.hooks.onOpen || onOpenNoOp
-
-        const client = new WebSocket(req, socket, body, subProtocols)
-
-        try {
-          await onOpen(client, url.searchParams)
-
-          const target =
-            route.target + url.pathname + '?' + url.searchParams.toString()
-          const remote = new WebSocket.Client(
-            target,
-            subProtocols,
-            route.proxyConfig
-          )
-
-          client.pipe(remote)
-          remote.pipe(client)
-        } catch (err) {
-          client.close(err.closeEventCode || 4500, err.message)
-        }
-      } else {
-        socket.end()
+  const onUnhandled = (socket) => {
+    if (server.listenerCount('upgrade') === 1) return socket.end()
+
+    // other 'upgrade' listeners on this server may still handle the socket
+    setTimeout(() => {
+      if (socket.writable && socket.bytesWritten === 0) socket.end()
+    }, UNHANDLED_UPGRADE_TIMEOUT).unref()
+  }
+
+  const onUpgrade = async (req, socket, body) => {
+    if (!WebSocket.isWebSocket(req)) return onUnhandled(socket)
+
+    const url = new URL('http://fw' + req.url)
+    const prefix = url.pathname
+
+    const match = matchers.find((matcher) => matcher.isMatch(prefix))
+    if (!match) return onUnhandled(socket)
+
+    const { route } = match
+
+    const subProtocols = route.subProtocols || []
+    const onOpen = (route.hooks && route.hooks.onOpen) || onOpenNoOp
+
+    const client = new WebSocket(req, socket, body, subProtocols)
+
+    // queue messages received while the onOpen hook is pending
+    const pending = []
+    let pendingBytes = 0
+    const queue = (event) => {
+      pendingBytes += Buffer.byteLength(event.data)
+      if (pendingBytes > MAX_PENDING_BYTES) {
+        client.removeListener('message', queue)
+        pending.length = 0
+        close(client, 4413, 'Too much data before the connection was ready')
+
+        return
       }
+      pending.push(event.data)
     }
+    client.on('message', queue)
+
+    try {
+      await onOpen(client, url.searchParams)
+      await handshake(client)
+      if (client.readyState !== OPEN) return
+
+      const target = route.target + url.pathname + url.search
+      const remote = new WebSocket.Client(
+        target,
+        client.protocol ? [client.protocol] : [],
+        route.proxyConfig
+      )
+
+      client.removeListener('message', queue)
+      pending.forEach((data) => remote.send(data))
+
+      relay(client, remote, () => close(remote, 1000))
+      // drop the client connection, so it sees an abnormal close (1006)
+      relay(remote, client, () => socket.destroy())
+    } catch (err) {
+      await handshake(client)
+      close(
+        client,
+        toCloseCode(err && err.closeEventCode, 4500),
+        err && err.message
+      )
+    }
+  }
+
+  server.on('upgrade', (req, socket, body) => {
+    onUpgrade(req, socket, body).catch(() => socket.destroy())
   })
 }
diff --git a/package-lock.json b/package-lock.json
index 9bc4c9d..5aab1fb 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,42 +1,45 @@
 {
   "name": "fast-gateway",
-  "version": "4.2.0",
+  "version": "6.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "fast-gateway",
-      "version": "4.2.0",
+      "version": "6.0.0",
       "license": "MIT",
       "dependencies": {
-        "fast-proxy-lite": "^1.1.2",
+        "fast-proxy-lite": "^1.1.3",
         "http-cache-middleware": "^1.4.1",
         "micromatch": "^4.0.8",
-        "restana": "^5.0.0",
+        "restana": "^7.0.0",
         "stream-to-array": "^2.3.0"
       },
       "devDependencies": {
-        "@types/express": "^5.0.0",
-        "@types/node": "^22.13.11",
-        "artillery": "^2.0.21",
-        "aws-sdk": "^2.1691.0",
-        "chai": "^4.5.0",
+        "@types/express": "^5.0.6",
+        "@types/node": "^26.6.5",
+        "artillery": "^2.0.31",
+        "aws-sdk": "^2.1693.0",
+        "chai": "^6.2.2",
         "consistent-hash": "^1.2.2",
-        "cors": "^2.8.5",
-        "express": "^5.0.1",
-        "express-jwt": "^7.7.8",
-        "express-rate-limit": "^6.11.2",
+        "cors": "^2.8.6",
+        "express": "^5.2.1",
+        "express-jwt": "^8.5.1",
+        "express-rate-limit": "^8.5.1",
         "faye-websocket": "^0.11.4",
         "fg-multiple-hooks": "^1.3.0",
-        "helmet": "^7.2.0",
+        "helmet": "^8.1.0",
         "http-lambda-proxy": "^1.1.4",
         "load-balancers": "^1.3.52",
-        "mocha": "^10.8.2",
-        "nyc": "^17.1.0",
+        "mocha": "^12.0.3",
+        "nyc": "^18.0.0",
         "pem": "^1.14.8",
         "request-ip": "^3.3.0",
-        "response-time": "^2.3.3",
-        "supertest": "^7.0.0"
+        "response-time": "^2.3.4",
+        "supertest": "^7.2.2"
+      },
+      "engines": {
+        "node": ">=24"
       }
     },
     "node_modules/@artilleryio/int-commons": {
@@ -3269,6 +3272,31 @@
         "@opentelemetry/api": ">=1.3.0 <1.10.0"
       }
     },
+    "node_modules/@opentelemetry/otlp-transformer/node_modules/protobufjs": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-8.0.0.tgz",
+      "integrity": "sha512-jx6+sE9h/UryaCZhsJWbJtTEy47yXoGNYI4z8ZaRncM0zBKeRqjO2JEcOUYwrYGb1WLhXM1FfMzW3annvFv0rw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@protobufjs/aspromise": "^1.1.2",
+        "@protobufjs/base64": "^1.1.2",
+        "@protobufjs/codegen": "^2.0.4",
+        "@protobufjs/eventemitter": "^1.1.0",
+        "@protobufjs/fetch": "^1.1.0",
+        "@protobufjs/float": "^1.0.2",
+        "@protobufjs/inquire": "^1.1.0",
+        "@protobufjs/path": "^1.1.2",
+        "@protobufjs/pool": "^1.1.0",
+        "@protobufjs/utf8": "^1.1.0",
+        "@types/node": ">=13.7.0",
+        "long": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/@opentelemetry/resources": {
       "version": "2.7.1",
       "dev": true,
@@ -3430,6 +3458,79 @@
         "node": ">=18"
       }
     },
+    "node_modules/@protobufjs/aspromise": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/aspromise/-/aspromise-1.1.2.tgz",
+      "integrity": "sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ==",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/base64": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/base64/-/base64-1.1.2.tgz",
+      "integrity": "sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg==",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/codegen": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.5.tgz",
+      "integrity": "sha512-zgXFLzW3Ap33e6d0Wlj4MGIm6Ce8O89n/apUaGNB/jx+hw+ruWEp7EwGUshdLKVRCxZW12fp9r40E1mQrf/34g==",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/eventemitter": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.1.tgz",
+      "integrity": "sha512-vW1GmwMZNnL+gMRaovlh9yZX74kc+TTU3FObkkurpMaRtBfLP3ldjS9KQWlwZgraRE0+dheEEoAxdzcJQ8eXZg==",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/fetch": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.1.tgz",
+      "integrity": "sha512-GpptLrs57adMSuHi3VNj0mAF8dwh36LMaYF6XyJ6JMWlVsc+t42tm1HSEDmOs3A8fC9yyeisgLhsTVQokOZ0zw==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@protobufjs/aspromise": "^1.1.1"
+      }
+    },
+    "node_modules/@protobufjs/float": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/float/-/float-1.0.2.tgz",
+      "integrity": "sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ==",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/inquire": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/inquire/-/inquire-1.1.2.tgz",
+      "integrity": "sha512-pa0vFRuws4wkvaXKK1uXZMAwAX4/t8ANaJo45iw/oQHNQ9q5xUzwgFmVJGXiga2BeN+zpX7Vf9vmsiIa2J+MUw==",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/path": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/path/-/path-1.1.2.tgz",
+      "integrity": "sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA==",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/pool": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@protobufjs/pool/-/pool-1.1.0.tgz",
+      "integrity": "sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw==",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/utf8": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.2.tgz",
+      "integrity": "sha512-b1UQwcEZ4yCnMCD8DAL1VlbvBJE9/IX4FTIp7BG1xYpf29SLazLSrqUkj4w7Y5y7cCVP6E5tcqqcI0xemPkHug==",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
     "node_modules/@sec-ant/readable-stream": {
       "version": "0.4.1",
       "dev": true,
@@ -4219,19 +4320,31 @@
       "license": "MIT"
     },
     "node_modules/@types/jsonwebtoken": {
-      "version": "8.5.9",
+      "version": "9.0.10",
+      "resolved": "https://registry.npmjs.org/@types/jsonwebtoken/-/jsonwebtoken-9.0.10.tgz",
+      "integrity": "sha512-asx5hIG9Qmf/1oStypjanR7iKTv0gXQ1Ov/jfrX6kS/EO0OFni8orbmGCn0672NHR3kXHwpAwR+B368ZGN/2rA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
+        "@types/ms": "*",
         "@types/node": "*"
       }
     },
+    "node_modules/@types/ms": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz",
+      "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/node": {
-      "version": "22.19.18",
+      "version": "26.6.5",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.5.tgz",
+      "integrity": "sha512-uMzsv9stDdofIZBx4UGh4Z9ZgXnGC9seRDscilBcTHAeOFk67MZg/k9bWVfO+bk4qZmG+l52hRnLwUiH2LnJTg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "undici-types": "~6.21.0"
+        "undici-types": "~8.9.0"
       }
     },
     "node_modules/@types/pako": {
@@ -4467,10 +4580,12 @@
       "license": "MIT"
     },
     "node_modules/0http": {
-      "version": "4.4.0",
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/0http/-/0http-5.2.0.tgz",
+      "integrity": "sha512-PcXG5vxB99csVSxJUUE2Sq/lnXxpi4RELFM8U2BNw39zdUsFyGssIyFAU1pV90ZNcZSu1XZFicBSDE8EfkjM4g==",
       "license": "MIT",
       "dependencies": {
-        "lru-cache": "^11.2.1",
+        "lru-cache": "^11.5.1",
         "regexparam": "^3.0.0",
         "trouter": "^4.0.0"
       },
@@ -4479,7 +4594,9 @@
       }
     },
     "node_modules/0http/node_modules/lru-cache": {
-      "version": "11.3.6",
+      "version": "11.5.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.3.tgz",
+      "integrity": "sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg==",
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": "20 || >=22"
@@ -4537,6 +4654,8 @@
     },
     "node_modules/aggregate-error": {
       "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/aggregate-error/-/aggregate-error-3.1.0.tgz",
+      "integrity": "sha512-4I7Td01quW/RpocfNayFdFVk1qSuoh0E7JrbRJ16nH01HhKFQ88INq9Sd+nd72zqRySlr9BmDA8xlEJ6vJMrYA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4549,14 +4668,8 @@
     },
     "node_modules/aggregate-error/node_modules/clean-stack": {
       "version": "2.2.0",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/ansi-colors": {
-      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/clean-stack/-/clean-stack-2.2.0.tgz",
+      "integrity": "sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4638,6 +4751,8 @@
     },
     "node_modules/archy": {
       "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/archy/-/archy-1.0.0.tgz",
+      "integrity": "sha512-Xg+9RwCg/0p32teKdGMPTPnVXKD0w3DfHnFTficozsAgsvq2XenPJq/MYpzzQ/v8zrOyJn6Ds39VA4JIDwFfqw==",
       "dev": true,
       "license": "MIT"
     },
@@ -4888,14 +5003,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/assertion-error": {
-      "version": "1.1.0",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "*"
-      }
-    },
     "node_modules/ast-module-types": {
       "version": "6.0.2",
       "dev": true,
@@ -5025,6 +5132,17 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/bindings": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
+      "integrity": "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "file-uri-to-path": "1.0.0"
+      }
+    },
     "node_modules/bintrees": {
       "version": "1.0.2",
       "dev": true,
@@ -5317,20 +5435,13 @@
       "license": "CC-BY-4.0"
     },
     "node_modules/chai": {
-      "version": "4.5.0",
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-6.3.0.tgz",
+      "integrity": "sha512-XWAtwJ6OHO+tj0EKCs0Y2UamnyOxseZWltU4x2U2wh8g4AigdjwvtUjvLP2tqkA/avxHEtzxNaqGq/YGNwckKg==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "assertion-error": "^1.1.0",
-        "check-error": "^1.0.3",
-        "deep-eql": "^4.1.3",
-        "get-func-name": "^2.0.2",
-        "loupe": "^2.3.6",
-        "pathval": "^1.1.1",
-        "type-detect": "^4.1.0"
-      },
       "engines": {
-        "node": ">=4"
+        "node": ">=18"
       }
     },
     "node_modules/chalk": {
@@ -5378,17 +5489,6 @@
         "node": "*"
       }
     },
-    "node_modules/check-error": {
-      "version": "1.0.3",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "get-func-name": "^2.0.2"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
     "node_modules/cheerio": {
       "version": "1.2.0",
       "dev": true,
@@ -5855,17 +5955,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/deep-eql": {
-      "version": "4.1.4",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "type-detect": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
     "node_modules/deep-extend": {
       "version": "0.6.0",
       "dev": true,
@@ -6126,7 +6215,9 @@
       }
     },
     "node_modules/diff": {
-      "version": "5.2.2",
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-9.0.0.tgz",
+      "integrity": "sha512-svtcdpS8CgJyqAjEQIXdb3OjhFVVYjzGAPO8WGCmRbrml64SPw/jJD4GoE98aR7r25A0XcgrK3F02yw9R/vhQw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -6612,27 +6703,38 @@
       }
     },
     "node_modules/express-jwt": {
-      "version": "7.7.8",
+      "version": "8.5.1",
+      "resolved": "https://registry.npmjs.org/express-jwt/-/express-jwt-8.5.1.tgz",
+      "integrity": "sha512-Dv6QjDLpR2jmdb8M6XQXiCcpEom7mK8TOqnr0/TngDKsG2DHVkO8+XnVxkJVN7BuS1I3OrGw6N8j5DaaGgkDRQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@types/jsonwebtoken": "^8.5.8",
+        "@types/jsonwebtoken": "^9",
         "express-unless": "^2.1.3",
-        "jsonwebtoken": "^9.0.2"
+        "jsonwebtoken": "^9.0.0"
       },
       "engines": {
         "node": ">= 8.0.0"
       }
     },
     "node_modules/express-rate-limit": {
-      "version": "6.11.2",
+      "version": "8.7.1",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.7.1.tgz",
+      "integrity": "sha512-2FXbqkygil3mZiXzEtM0IjE/UBmBNot0J1GEVrJT4JbrvwOSoEtqtO+wHbiMQELWe1eNvHoYRg2dkjOid+6JkA==",
       "dev": true,
       "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.3",
+        "ip-address": "^10.2.0"
+      },
       "engines": {
-        "node": ">= 14"
+        "node": ">= 16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/express-rate-limit"
       },
       "peerDependencies": {
-        "express": "^4 || ^5"
+        "express": ">= 4.11"
       }
     },
     "node_modules/express-unless": {
@@ -6670,7 +6772,9 @@
       }
     },
     "node_modules/fast-proxy-lite": {
-      "version": "1.1.2",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/fast-proxy-lite/-/fast-proxy-lite-1.1.3.tgz",
+      "integrity": "sha512-BM2HZ5rvrCRrtlKoab6g76ZHbKVNBUnZek7A6pFwh79Gvg+4NBduyoAJFIxpDD+xUgmEF1GEBkLeIXgV70e4nw==",
       "license": "MIT",
       "dependencies": {
         "pump": "^3.0.0",
@@ -6769,6 +6873,14 @@
         "stream-to-array": "^2.3.0"
       }
     },
+    "node_modules/file-uri-to-path": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
+      "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
     "node_modules/filelist": {
       "version": "1.0.6",
       "dev": true,
@@ -6962,6 +7074,19 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/find-up-simple": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/find-up-simple/-/find-up-simple-1.0.1.tgz",
+      "integrity": "sha512-afd4O7zpqHeRyg4PfDQsXmlDe2PfdHtJt6Akt8jOWaApLOZk5JXs6VMR29lz03pRe9mpykrRCYIYxaJYcfpncQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/find-versions": {
       "version": "4.0.0",
       "dev": true,
@@ -6976,14 +7101,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/flat": {
-      "version": "5.0.2",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "bin": {
-        "flat": "cli.js"
-      }
-    },
     "node_modules/for-each": {
       "version": "0.3.5",
       "dev": true,
@@ -7119,10 +7236,20 @@
         "node": ">=14.14"
       }
     },
-    "node_modules/fs.realpath": {
-      "version": "1.0.0",
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
       "dev": true,
-      "license": "ISC"
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
     },
     "node_modules/function-bind": {
       "version": "1.1.2",
@@ -7168,14 +7295,6 @@
         "node": "6.* || 8.* || >= 10.*"
       }
     },
-    "node_modules/get-func-name": {
-      "version": "2.0.2",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "*"
-      }
-    },
     "node_modules/get-intrinsic": {
       "version": "1.3.0",
       "dev": true,
@@ -7240,18 +7359,18 @@
       }
     },
     "node_modules/glob": {
-      "version": "8.1.0",
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^5.0.1",
-        "once": "^1.3.0"
+        "minimatch": "^10.2.2",
+        "minipass": "^7.1.3",
+        "path-scurry": "^2.0.2"
       },
       "engines": {
-        "node": ">=12"
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
@@ -7268,30 +7387,6 @@
         "node": ">= 6"
       }
     },
-    "node_modules/glob/node_modules/balanced-match": {
-      "version": "1.0.2",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/glob/node_modules/brace-expansion": {
-      "version": "2.1.0",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0"
-      }
-    },
-    "node_modules/glob/node_modules/minimatch": {
-      "version": "5.1.9",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
     "node_modules/gonzales-pe": {
       "version": "4.3.0",
       "dev": true,
@@ -7472,20 +7567,17 @@
         "node": ">= 0.4"
       }
     },
-    "node_modules/he": {
-      "version": "1.2.0",
-      "dev": true,
-      "license": "MIT",
-      "bin": {
-        "he": "bin/he"
-      }
-    },
     "node_modules/helmet": {
-      "version": "7.2.0",
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/helmet/-/helmet-8.3.0.tgz",
+      "integrity": "sha512-Qgpiaws3Sm30Av8Eah6sjMCZZwjlBu+E68rhpCWBshY1lb09HtLwj5GviX0OyQIn+ulUS0iX0AxN5n3tLZzz1w==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=16.0.0"
+        "node": ">=18.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/EvanHahn"
       }
     },
     "node_modules/hot-shots": {
@@ -7784,15 +7876,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/inflight": {
-      "version": "1.0.6",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "once": "^1.3.0",
-        "wrappy": "1"
-      }
-    },
     "node_modules/inherits": {
       "version": "2.0.4",
       "dev": true,
@@ -7803,6 +7886,16 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/ip-address": {
+      "version": "10.7.4",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.4.tgz",
+      "integrity": "sha512-DWBMKyeM25D70nrIiTkgQth59/G+naKOTep6huF9j+GmeK3DMD60Zvxg5d5qQnz+38AHgou6ean2LECX+lrKDg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12"
+      }
+    },
     "node_modules/ipaddr.js": {
       "version": "1.9.1",
       "dev": true,
@@ -7985,12 +8078,17 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/is-plain-obj": {
-      "version": "2.1.0",
+    "node_modules/is-path-inside": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/is-path-inside/-/is-path-inside-4.0.0.tgz",
+      "integrity": "sha512-lJJV/5dYS+RcL8uQdBDW9c9uWFLLBNRyFhnAKXw5tVqLlKZ4RMGZKv+YQ/IA3OhD+RpbJa1LLFM1FQPGyIXvOA==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=8"
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/is-promise": {
@@ -8055,6 +8153,8 @@
     },
     "node_modules/is-unicode-supported": {
       "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/is-unicode-supported/-/is-unicode-supported-0.1.0.tgz",
+      "integrity": "sha512-knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -8077,6 +8177,8 @@
     },
     "node_modules/is-windows": {
       "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/is-windows/-/is-windows-1.0.2.tgz",
+      "integrity": "sha512-eXK1UInq2bPmjyX6e3VHIzMLobc4J94i4AWn+Hpq3OU5KkrRC96OAcR3PRJ/pGu6m8TRnBHP9dkXQVsT/COVIA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -8139,7 +8241,9 @@
       }
     },
     "node_modules/istanbul-lib-processinfo": {
-      "version": "2.0.3",
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-processinfo/-/istanbul-lib-processinfo-3.0.1.tgz",
+      "integrity": "sha512-s3mX05h5wGZeScG6XnOanygPh4SJu5ujMc9YbvpnLGXWy1cRiGbp0NdVcjHxgoZt3WfQppfBsa0y+gWdYJ2pGQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -8147,19 +8251,10 @@
         "cross-spawn": "^7.0.3",
         "istanbul-lib-coverage": "^3.2.0",
         "p-map": "^3.0.0",
-        "rimraf": "^3.0.0",
-        "uuid": "^8.3.2"
+        "rimraf": "^6.1.3"
       },
       "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/istanbul-lib-processinfo/node_modules/uuid": {
-      "version": "8.3.2",
-      "dev": true,
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist/bin/uuid"
+        "node": "20 || >=22"
       }
     },
     "node_modules/istanbul-lib-report": {
@@ -8491,122 +8586,43 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/log-symbols": {
-      "version": "4.1.0",
+    "node_modules/loglevel": {
+      "version": "1.9.2",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "chalk": "^4.1.0",
-        "is-unicode-supported": "^0.1.0"
-      },
       "engines": {
-        "node": ">=10"
+        "node": ">= 0.6.0"
       },
       "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "type": "tidelift",
+        "url": "https://tidelift.com/funding/github/npm/loglevel"
       }
     },
-    "node_modules/log-symbols/node_modules/ansi-styles": {
-      "version": "4.3.0",
+    "node_modules/long": {
+      "version": "5.3.2",
+      "dev": true,
+      "license": "Apache-2.0"
+    },
+    "node_modules/lowercase-keys": {
+      "version": "3.0.0",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "color-convert": "^2.0.1"
-      },
       "engines": {
-        "node": ">=8"
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
       },
       "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/log-symbols/node_modules/chalk": {
-      "version": "4.1.2",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
-      }
-    },
-    "node_modules/log-symbols/node_modules/color-convert": {
-      "version": "2.0.1",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "color-name": "~1.1.4"
-      },
-      "engines": {
-        "node": ">=7.0.0"
-      }
-    },
-    "node_modules/log-symbols/node_modules/color-name": {
-      "version": "1.1.4",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/log-symbols/node_modules/supports-color": {
-      "version": "7.2.0",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "has-flag": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/loglevel": {
-      "version": "1.9.2",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6.0"
-      },
-      "funding": {
-        "type": "tidelift",
-        "url": "https://tidelift.com/funding/github/npm/loglevel"
-      }
-    },
-    "node_modules/long": {
-      "version": "5.3.2",
-      "dev": true,
-      "license": "Apache-2.0"
-    },
-    "node_modules/loupe": {
-      "version": "2.3.7",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "get-func-name": "^2.0.1"
-      }
-    },
-    "node_modules/lowercase-keys": {
-      "version": "3.0.0",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/lru-cache": {
-      "version": "7.18.3",
-      "license": "ISC",
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/magic-string": {
-      "version": "0.30.21",
+    "node_modules/lru-cache": {
+      "version": "7.18.3",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/magic-string": {
+      "version": "0.30.21",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8832,6 +8848,16 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/minipass": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
     "node_modules/mixpanel": {
       "version": "0.18.1",
       "dev": true,
@@ -8867,115 +8893,104 @@
       }
     },
     "node_modules/mocha": {
-      "version": "10.8.2",
+      "version": "12.0.3",
+      "resolved": "https://registry.npmjs.org/mocha/-/mocha-12.0.3.tgz",
+      "integrity": "sha512-beammieDdiWdkjANWeWPpkxUROYGi5FN88fPOkLiticz7HTg3Y+Pho3EYE6SUdcuWnZ3h2WD8EXCA55JF4o6wg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "ansi-colors": "^4.1.3",
         "browser-stdout": "^1.3.1",
-        "chokidar": "^3.5.3",
+        "chokidar": "^5.0.0",
         "debug": "^4.3.5",
-        "diff": "^5.2.0",
-        "escape-string-regexp": "^4.0.0",
-        "find-up": "^5.0.0",
-        "glob": "^8.1.0",
-        "he": "^1.2.0",
-        "js-yaml": "^4.1.0",
-        "log-symbols": "^4.1.0",
-        "minimatch": "^5.1.6",
+        "diff": "^9.0.0",
+        "find-up-simple": "^1.0.1",
+        "glob": "^13.0.0",
+        "is-path-inside": "^4.0.0",
+        "is-unicode-supported": "^0.1.0",
+        "js-yaml": "^5.0.0",
+        "minimatch": "^10.2.2",
         "ms": "^2.1.3",
-        "serialize-javascript": "^6.0.2",
-        "strip-json-comments": "^3.1.1",
+        "picocolors": "^1.1.1",
+        "serialize-javascript": "^7.1.1",
+        "strip-json-comments": "^5.0.3",
         "supports-color": "^8.1.1",
-        "workerpool": "^6.5.1",
-        "yargs": "^16.2.0",
-        "yargs-parser": "^20.2.9",
-        "yargs-unparser": "^2.0.0"
+        "workerpool": "^10.0.0"
       },
       "bin": {
-        "_mocha": "bin/_mocha",
         "mocha": "bin/mocha.js"
       },
       "engines": {
-        "node": ">= 14.0.0"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
     "node_modules/mocha/node_modules/argparse": {
-      "version": "2.0.1",
-      "dev": true,
-      "license": "Python-2.0"
-    },
-    "node_modules/mocha/node_modules/balanced-match": {
-      "version": "1.0.2",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-3.0.4.tgz",
+      "integrity": "sha512-fwWK3Zq22l4XJJjx5mcBHGikIk+hJqO+32dPm0Jur7+rtG5x1scOjSfdT9ZKeWHPpsya/l0HHK4tDImBkTrtvA==",
       "dev": true,
-      "license": "MIT"
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
+      "license": "PSF-2.0"
     },
-    "node_modules/mocha/node_modules/brace-expansion": {
-      "version": "2.1.0",
+    "node_modules/mocha/node_modules/chokidar": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-5.0.0.tgz",
+      "integrity": "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "balanced-match": "^1.0.0"
-      }
-    },
-    "node_modules/mocha/node_modules/cliui": {
-      "version": "7.0.4",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "string-width": "^4.2.0",
-        "strip-ansi": "^6.0.0",
-        "wrap-ansi": "^7.0.0"
-      }
-    },
-    "node_modules/mocha/node_modules/escape-string-regexp": {
-      "version": "4.0.0",
-      "dev": true,
-      "license": "MIT",
+        "readdirp": "^5.0.0"
+      },
       "engines": {
-        "node": ">=10"
+        "node": ">= 20.19.0"
       },
       "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "url": "https://paulmillr.com/funding/"
       }
     },
     "node_modules/mocha/node_modules/js-yaml": {
-      "version": "4.1.1",
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.5.0.tgz",
+      "integrity": "sha512-paNr4LFIFPjeeSmwNYdrb8FafLLG/Cr2Af3GjbsHJ5CxIjH4r0c2emlmRdAtpPAieP1gRVzk6buBbVP5gBMGAg==",
       "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
       "license": "MIT",
       "dependencies": {
-        "argparse": "^2.0.1"
+        "argparse": "^3.0.3"
       },
       "bin": {
-        "js-yaml": "bin/js-yaml.js"
-      }
-    },
-    "node_modules/mocha/node_modules/minimatch": {
-      "version": "5.1.9",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=10"
+        "js-yaml": "bin/js-yaml.mjs"
       }
     },
-    "node_modules/mocha/node_modules/yargs": {
-      "version": "16.2.0",
+    "node_modules/mocha/node_modules/readdirp": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-5.1.1.tgz",
+      "integrity": "sha512-Kko+Y5XQ6fM+Ce3dq3m9YGxnacYZYl9cA1wZjaF3Vbry2L3i1qVg8+CAgNPsXRArPMUMCaOR7oa9Nqntc43JKA==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "cliui": "^7.0.2",
-        "escalade": "^3.1.1",
-        "get-caller-file": "^2.0.5",
-        "require-directory": "^2.1.1",
-        "string-width": "^4.2.0",
-        "y18n": "^5.0.5",
-        "yargs-parser": "^20.2.2"
-      },
       "engines": {
-        "node": ">=10"
+        "node": ">= 20.19.0"
+      },
+      "funding": {
+        "type": "individual",
+        "url": "https://paulmillr.com/funding/"
       }
     },
     "node_modules/module-definition": {
@@ -9029,6 +9044,14 @@
         "node": "^18.17.0 || >=20.5.0"
       }
     },
+    "node_modules/nan": {
+      "version": "2.30.0",
+      "resolved": "https://registry.npmjs.org/nan/-/nan-2.30.0.tgz",
+      "integrity": "sha512-P5mokDkSvCGBz6mZDD/2l+w9QoICRXdCyZ9ONGmTePr40oihJg3Kpn0YU3twKd6PJnwSlLBWNQeOT6yWEV2c4A==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
     "node_modules/nanoid": {
       "version": "3.3.12",
       "dev": true,
@@ -9136,7 +9159,9 @@
       }
     },
     "node_modules/nyc": {
-      "version": "17.1.0",
+      "version": "18.0.0",
+      "resolved": "https://registry.npmjs.org/nyc/-/nyc-18.0.0.tgz",
+      "integrity": "sha512-G5UyHinFkB1BxqGTrmZdB6uIYH0+v7ZnVssuflUDi+J+RhKWyAhRT1RCehBSI6jLFLuUUgFDyLt49mUtdO1XeQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -9149,11 +9174,11 @@
         "find-up": "^4.1.0",
         "foreground-child": "^3.3.0",
         "get-package-type": "^0.1.0",
-        "glob": "^7.1.6",
+        "glob": "^13.0.6",
         "istanbul-lib-coverage": "^3.0.0",
         "istanbul-lib-hook": "^3.0.0",
         "istanbul-lib-instrument": "^6.0.2",
-        "istanbul-lib-processinfo": "^2.0.2",
+        "istanbul-lib-processinfo": "^3.0.0",
         "istanbul-lib-report": "^3.0.0",
         "istanbul-lib-source-maps": "^4.0.0",
         "istanbul-reports": "^3.0.2",
@@ -9162,17 +9187,17 @@
         "p-map": "^3.0.0",
         "process-on-spawn": "^1.0.0",
         "resolve-from": "^5.0.0",
-        "rimraf": "^3.0.0",
+        "rimraf": "^6.1.3",
         "signal-exit": "^3.0.2",
-        "spawn-wrap": "^2.0.0",
-        "test-exclude": "^6.0.0",
+        "spawn-wrap": "^3.0.0",
+        "test-exclude": "^8.0.0",
         "yargs": "^15.0.2"
       },
       "bin": {
         "nyc": "bin/nyc.js"
       },
       "engines": {
-        "node": ">=18"
+        "node": "20 || >=22"
       }
     },
     "node_modules/nyc/node_modules/ansi-styles": {
@@ -9189,20 +9214,6 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
-    "node_modules/nyc/node_modules/balanced-match": {
-      "version": "1.0.2",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/nyc/node_modules/brace-expansion": {
-      "version": "1.1.14",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
-      }
-    },
     "node_modules/nyc/node_modules/cliui": {
       "version": "6.0.0",
       "dev": true,
@@ -9241,25 +9252,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/nyc/node_modules/glob": {
-      "version": "7.2.3",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.1.1",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
-      },
-      "engines": {
-        "node": "*"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/nyc/node_modules/locate-path": {
       "version": "5.0.0",
       "dev": true,
@@ -9271,17 +9263,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/nyc/node_modules/minimatch": {
-      "version": "3.1.5",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^1.1.7"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
     "node_modules/nyc/node_modules/p-limit": {
       "version": "2.3.0",
       "dev": true,
@@ -9659,6 +9640,8 @@
     },
     "node_modules/p-map": {
       "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/p-map/-/p-map-3.0.0.tgz",
+      "integrity": "sha512-d3qXVTF/s+W+CdJ5A29wywV2n8CQQYahlgz2bFiA+4eVNJbHJodPZ+/gXwPGh0bOqA+j8S+6+ckmvLGPk1QpxQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9690,6 +9673,13 @@
         "node": ">=8"
       }
     },
+    "node_modules/package-json-from-dist": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
+      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0"
+    },
     "node_modules/pako": {
       "version": "2.1.0",
       "dev": true,
@@ -9798,14 +9788,6 @@
         "node": ">=14.0.0"
       }
     },
-    "node_modules/path-is-absolute": {
-      "version": "1.0.1",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/path-key": {
       "version": "3.1.1",
       "dev": true,
@@ -9819,6 +9801,33 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/path-scurry": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^11.0.0",
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/path-scurry/node_modules/lru-cache": {
+      "version": "11.5.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.3.tgz",
+      "integrity": "sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
     "node_modules/path-to-regexp": {
       "version": "8.4.2",
       "dev": true,
@@ -9836,14 +9845,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/pathval": {
-      "version": "1.1.1",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "*"
-      }
-    },
     "node_modules/pem": {
       "version": "1.14.8",
       "dev": true,
@@ -9912,6 +9913,21 @@
         "node": ">=18"
       }
     },
+    "node_modules/playwright/node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
     "node_modules/please-upgrade-node": {
       "version": "3.2.0",
       "dev": true,
@@ -10031,6 +10047,30 @@
         "node": ">=10"
       }
     },
+    "node_modules/protobufjs": {
+      "version": "7.6.6",
+      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.6.tgz",
+      "integrity": "sha512-dYDWdjSl5RNb7SgPxGQcRU+GtvP7s2fpkrY0r432PcOIaZ0/rBcxEZnQN67iJhFuQiVw754JDoPruPCNdGsbjg==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@protobufjs/aspromise": "^1.1.2",
+        "@protobufjs/base64": "^1.1.2",
+        "@protobufjs/codegen": "^2.0.5",
+        "@protobufjs/eventemitter": "^1.1.1",
+        "@protobufjs/fetch": "^1.1.1",
+        "@protobufjs/float": "^1.0.2",
+        "@protobufjs/path": "^1.1.2",
+        "@protobufjs/pool": "^1.1.0",
+        "@protobufjs/utf8": "^1.1.1",
+        "@types/node": ">=13.7.0",
+        "long": "^5.3.2"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/proxy-addr": {
       "version": "2.0.7",
       "dev": true,
@@ -10093,14 +10133,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/randombytes": {
-      "version": "2.1.0",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "safe-buffer": "^5.1.0"
-      }
-    },
     "node_modules/range-parser": {
       "version": "1.2.1",
       "dev": true,
@@ -10158,6 +10190,8 @@
     },
     "node_modules/regexparam": {
       "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/regexparam/-/regexparam-3.0.0.tgz",
+      "integrity": "sha512-RSYAtP31mvYLkAHrOlh25pCNQ5hWnT106VukGaaFfuJrZFkGRX5GhUAdPqpSDXxOhA2c4akmRuplv1mRqnBn6Q==",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -10284,14 +10318,15 @@
       }
     },
     "node_modules/restana": {
-      "version": "v5.2.0",
-      "hasInstallScript": true,
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/restana/-/restana-7.0.0.tgz",
+      "integrity": "sha512-DH0WkVRfSWZ2gBSOrz4p3sphsdk/o/itYqCANlqXUU3LVAG6NdIOUdwg2dUdqqCSrAApTW4U0Sa2ArQwaM6fUA==",
       "license": "MIT",
       "dependencies": {
-        "0http": "^4.4.0"
+        "0http": "^5.2.0"
       },
       "engines": {
-        "node": ">=10.x"
+        "node": ">=24.x"
       }
     },
     "node_modules/restore-cursor": {
@@ -10319,63 +10354,25 @@
       }
     },
     "node_modules/rimraf": {
-      "version": "3.0.2",
+      "version": "6.1.3",
+      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-6.1.3.tgz",
+      "integrity": "sha512-LKg+Cr2ZF61fkcaK1UdkH2yEBBKnYjTyWzTJT6KNPcSPaiT7HSdhtMXQuN5wkTX0Xu72KQ1l8S42rlmexS2hSA==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "dependencies": {
-        "glob": "^7.1.3"
+        "glob": "^13.0.3",
+        "package-json-from-dist": "^1.0.1"
       },
       "bin": {
-        "rimraf": "bin.js"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/rimraf/node_modules/balanced-match": {
-      "version": "1.0.2",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/rimraf/node_modules/brace-expansion": {
-      "version": "1.1.14",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
-      }
-    },
-    "node_modules/rimraf/node_modules/glob": {
-      "version": "7.2.3",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.1.1",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
+        "rimraf": "dist/esm/bin.mjs"
       },
       "engines": {
-        "node": "*"
+        "node": "20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/rimraf/node_modules/minimatch": {
-      "version": "3.1.5",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^1.1.7"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
     "node_modules/router": {
       "version": "2.2.0",
       "dev": true,
@@ -10540,11 +10537,13 @@
       }
     },
     "node_modules/serialize-javascript": {
-      "version": "6.0.2",
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.1.4.tgz",
+      "integrity": "sha512-FqlEuoTq/zRmA4Lg6aOqyH3lCHbUtCB0bmHCeFniX2GBdDqMJM3FwdvEhlE5Pim1dlt2FfBdVPmUNNiGhhKqpw==",
       "dev": true,
       "license": "BSD-3-Clause",
-      "dependencies": {
-        "randombytes": "^2.1.0"
+      "engines": {
+        "node": ">=20.0.0"
       }
     },
     "node_modules/serve-static": {
@@ -10745,14 +10744,17 @@
       }
     },
     "node_modules/spawn-wrap": {
-      "version": "2.0.0",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/spawn-wrap/-/spawn-wrap-3.0.0.tgz",
+      "integrity": "sha512-z+s5vv4KzFPJVddGab0xX2n7kQPGMdNUX5l9T8EJqsXdKTWpcxmAqWHpsgHEXoC1taGBCc7b79bi62M5kdbrxQ==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "dependencies": {
+        "cross-spawn": "^7.0.6",
         "foreground-child": "^2.0.0",
         "is-windows": "^1.0.2",
         "make-dir": "^3.0.0",
-        "rimraf": "^3.0.0",
+        "rimraf": "^6.1.3",
         "signal-exit": "^3.0.2",
         "which": "^2.0.1"
       },
@@ -10762,6 +10764,8 @@
     },
     "node_modules/spawn-wrap/node_modules/foreground-child": {
       "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-2.0.0.tgz",
+      "integrity": "sha512-dCIq9FpEcyQyXKCkyzmlPTFNgrCzPudOe+mhvJU5zAtlBnGVy2yKxtfsxK2tQBThwq225jcvBjpw1Gr40uzZCA==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -10774,6 +10778,8 @@
     },
     "node_modules/spawn-wrap/node_modules/signal-exit": {
       "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
       "dev": true,
       "license": "ISC"
     },
@@ -10855,11 +10861,13 @@
       }
     },
     "node_modules/strip-json-comments": {
-      "version": "3.1.1",
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-5.0.3.tgz",
+      "integrity": "sha512-1tB5mhVo7U+ETBKNf92xT4hrQa3pm0MZ0PQvuDnWgAAGHDsfp4lPSpiS6psrSiet87wyGPh9ft6wmhOMQ0hDiw==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=8"
+        "node": ">=14.16"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
@@ -11023,60 +11031,18 @@
       }
     },
     "node_modules/test-exclude": {
-      "version": "6.0.0",
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-8.0.0.tgz",
+      "integrity": "sha512-ZOffsNrXYggvU1mDGHk54I96r26P8SyMjO5slMKSc7+IWmtB/MQKnEC2fP51imB3/pT6YK5cT5E8f+Dd9KdyOQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
         "@istanbuljs/schema": "^0.1.2",
-        "glob": "^7.1.4",
-        "minimatch": "^3.0.4"
+        "glob": "^13.0.6",
+        "minimatch": "^10.2.2"
       },
       "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/test-exclude/node_modules/balanced-match": {
-      "version": "1.0.2",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/test-exclude/node_modules/brace-expansion": {
-      "version": "1.1.14",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
-      }
-    },
-    "node_modules/test-exclude/node_modules/glob": {
-      "version": "7.2.3",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.1.1",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
-      },
-      "engines": {
-        "node": "*"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/test-exclude/node_modules/minimatch": {
-      "version": "3.1.5",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^1.1.7"
-      },
-      "engines": {
-        "node": "*"
+        "node": "20 || >=22"
       }
     },
     "node_modules/tiny-lru": {
@@ -11180,6 +11146,8 @@
     },
     "node_modules/trouter": {
       "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/trouter/-/trouter-4.0.0.tgz",
+      "integrity": "sha512-bwwr76BThfiVwAFZqks5cJ+VoKNM3/2Yg1ZwJslkdmAUQ6S0UNoCoGYFDxdw+u1skfexggdmD2p35kW5Td4Cug==",
       "license": "MIT",
       "dependencies": {
         "regexparam": "^3.0.0"
@@ -11225,14 +11193,6 @@
       "dev": true,
       "license": "0BSD"
     },
-    "node_modules/type-detect": {
-      "version": "4.1.0",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/type-fest": {
       "version": "0.21.3",
       "dev": true,
@@ -11291,7 +11251,9 @@
       }
     },
     "node_modules/undici-types": {
-      "version": "6.21.0",
+      "version": "8.9.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
+      "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
       "dev": true,
       "license": "MIT"
     },
@@ -11317,6 +11279,22 @@
         "node": ">= 10.0.0"
       }
     },
+    "node_modules/unix-dgram": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/unix-dgram/-/unix-dgram-2.0.7.tgz",
+      "integrity": "sha512-pWaQorcdxEUBFIKjCqqIlQaOoNVmchyoaNAJ/1LwyyfK2XSxcBhgJNiSE8ZRhR0xkNGyk4xInt1G03QPoKXY5A==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "bindings": "^1.5.0",
+        "nan": "^2.20.0"
+      },
+      "engines": {
+        "node": ">=0.10.48"
+      }
+    },
     "node_modules/unpipe": {
       "version": "1.0.0",
       "dev": true,
@@ -11546,7 +11524,9 @@
       "license": "MIT"
     },
     "node_modules/workerpool": {
-      "version": "6.5.1",
+      "version": "10.0.3",
+      "resolved": "https://registry.npmjs.org/workerpool/-/workerpool-10.0.3.tgz",
+      "integrity": "sha512-6z2Iis68Wqth93/G/wJP9u+R3O+d2XTlgWChGCwuT1qLbBsOYueGRZuJ++v3mtDP5KjYdy+WzvWC+VWETSVXJA==",
       "dev": true,
       "license": "Apache-2.0"
     },
@@ -11751,50 +11731,6 @@
         "node": ">=12"
       }
     },
-    "node_modules/yargs-parser": {
-      "version": "20.2.9",
-      "dev": true,
-      "license": "ISC",
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/yargs-unparser": {
-      "version": "2.0.0",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "camelcase": "^6.0.0",
-        "decamelize": "^4.0.0",
-        "flat": "^5.0.2",
-        "is-plain-obj": "^2.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/yargs-unparser/node_modules/camelcase": {
-      "version": "6.3.0",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/yargs-unparser/node_modules/decamelize": {
-      "version": "4.0.0",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/yargs/node_modules/yargs-parser": {
       "version": "21.1.1",
       "dev": true,
diff --git a/package.json b/package.json
index 8ed4cc4..e46257d 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "fast-gateway",
-  "version": "5.0.1",
+  "version": "6.0.0",
   "description": "A Node.js API Gateway for the masses!",
   "main": "index.js",
   "types": "index.d.ts",
@@ -10,6 +10,13 @@
     "lint": "npx standard",
     "ws-bench": "npx artillery run benchmark/websocket/artillery-perf1.yml"
   },
+  "nyc": {
+    "check-coverage": true,
+    "branches": 99,
+    "functions": 99,
+    "lines": 99,
+    "statements": 99
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/jkyberneees/fast-gateway.git"
@@ -27,11 +34,14 @@
     "url": "https://github.com/jkyberneees/fast-gateway/issues"
   },
   "homepage": "https://github.com/jkyberneees/fast-gateway#readme",
+  "engines": {
+    "node": ">=24"
+  },
   "dependencies": {
     "fast-proxy-lite": "^1.1.3",
     "http-cache-middleware": "^1.4.1",
     "micromatch": "^4.0.8",
-    "restana": "^6.0.0",
+    "restana": "^7.0.0",
     "stream-to-array": "^2.3.0"
   },
   "files": [
@@ -43,7 +53,7 @@
   ],
   "devDependencies": {
     "@types/express": "^5.0.6",
-    "@types/node": "^25.7.0",
+    "@types/node": "^26.6.5",
     "artillery": "^2.0.31",
     "aws-sdk": "^2.1693.0",
     "chai": "^6.2.2",
@@ -57,7 +67,7 @@
     "helmet": "^8.1.0",
     "http-lambda-proxy": "^1.1.4",
     "load-balancers": "^1.3.52",
-    "mocha": "^11.7.5",
+    "mocha": "^12.0.3",
     "nyc": "^18.0.0",
     "pem": "^1.14.8",
     "request-ip": "^3.3.0",
diff --git a/test/default-hooks.test.js b/test/default-hooks.test.js
new file mode 100644
index 0000000..4bdd603
--- /dev/null
+++ b/test/default-hooks.test.js
@@ -0,0 +1,208 @@
+'use strict'
+
+/* global describe, it, before, after */
+const expect = require('chai').expect
+const request = require('supertest')
+const http = require('http')
+const net = require('net')
+const fastGateway = require('../index')
+const defaultHooks = require('../lib/default-hooks')
+const rawRequest = require('./raw-http')
+
+const UPSTREAM_PORT = 9551
+const GATEWAY_PORT = 9552
+const RAW_UPSTREAM_PORT = 9553
+
+const binaryParser = (res, cb) => {
+  const chunks = []
+  res.on('data', (chunk) => chunks.push(chunk))
+  res.on('end', () => cb(null, Buffer.concat(chunks)))
+}
+
+const lambdaRoute = (prefix, payload, response = { StatusCode: 200 }) => ({
+  prefix,
+  proxyType: 'lambda',
+  target: 'a-lambda-function',
+  proxyConfig: {
+    lambdaProxy: (params, cb) => setImmediate(() => cb(null, {
+      ...response,
+      Payload: JSON.stringify(payload)
+    }))
+  }
+})
+
+describe('default hooks', () => {
+  let gateway, upstream, rawUpstream
+  const upstreamClosed = []
+  const pending = []
+
+  before(async () => {
+    upstream = http.createServer((req, res) => {
+      // the gateway always appends '?' when forwarding req.query, ignore it
+      req.url = req.url.replace(/\?$/, '')
+      if (req.url === '/large-chunked') {
+        res.setHeader('content-type', 'application/octet-stream')
+        res.write(Buffer.alloc(2 * 1024 * 1024, 'x'))
+        res.end()
+      } else if (req.url === '/endless') {
+        res.on('close', () => upstreamClosed.push(req.url))
+        const timer = setInterval(() => res.write('data: tick\n\n'), 20)
+        res.on('close', () => clearInterval(timer))
+        pending.push(res)
+      } else if (req.url === '/gzip-aborted') {
+        res.writeHead(200, { 'content-type': 'application/json', 'content-encoding': 'gzip' })
+        res.write(Buffer.from([0x1f, 0x8b]))
+        setTimeout(() => res.destroy(), 20)
+      }
+    })
+    await new Promise((resolve) => upstream.listen(UPSTREAM_PORT, resolve))
+
+    // writes a response node's http server can't produce
+    rawUpstream = net.createServer((socket) => {
+      socket.once('data', () => {
+        socket.end('HTTP/1.1 200 OK\r\nTransfer-Encoding: gzip, chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n')
+      })
+    })
+    await new Promise((resolve) => rawUpstream.listen(RAW_UPSTREAM_PORT, resolve))
+
+    gateway = fastGateway({
+      routes: [
+        { prefix: '/http', target: `http://127.0.0.1:${UPSTREAM_PORT}` },
+        { prefix: '/raw', target: `http://127.0.0.1:${RAW_UPSTREAM_PORT}` },
+        lambdaRoute('/lambda-no-status', { body: 'no status' }, {}),
+        lambdaRoute('/lambda-no-body', { statusCode: 204 }),
+        lambdaRoute('/lambda-no-status-code', { body: 'hello' }),
+        lambdaRoute('/lambda-object-body', { statusCode: 201, body: { name: 'fast-gateway' } }),
+        lambdaRoute('/lambda-base64', {
+          statusCode: 200,
+          headers: { 'content-type': 'image/png' },
+          isBase64Encoded: true,
+          body: Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x00, 0xff]).toString('base64')
+        })
+      ]
+    })
+    await gateway.start(GATEWAY_PORT)
+  })
+
+  after(async () => {
+    pending.forEach((res) => res.destroy())
+    await gateway.close()
+    upstream.closeAllConnections()
+    await new Promise((resolve) => upstream.close(resolve))
+    await new Promise((resolve) => rawUpstream.close(resolve))
+  })
+
+  describe('http', () => {
+    it('(Connection: close) chunked response above the buffer limit is streamed', async () => {
+      await request(gateway)
+        .get('/http/large-chunked')
+        .set('Connection', 'close')
+        .buffer(true)
+        .parse(binaryParser)
+        .expect(200)
+        .then((response) => {
+          expect(response.body.length).to.equal(2 * 1024 * 1024)
+        })
+    })
+
+    it('(Connection: close) upstream is released when the client goes away while buffering', async () => {
+      await new Promise((resolve) => {
+        const req = http.get({
+          port: GATEWAY_PORT,
+          path: '/http/endless',
+          headers: { Connection: 'close' }
+        })
+        req.on('error', () => {})
+        setTimeout(() => {
+          req.destroy()
+          resolve()
+        }, 100)
+      })
+
+      await new Promise((resolve) => setTimeout(resolve, 200))
+      expect(upstreamClosed).to.deep.equal(['/endless'])
+    })
+
+    it('(Connection: close) buffered response does not mix transfer-encoding and content-length', async () => {
+      const response = await rawRequest(GATEWAY_PORT, '/raw/gzip-chunked')
+
+      expect(response.statusCode).to.equal(200)
+      expect(response.headers['transfer-encoding']).to.equal(undefined)
+      expect(response.headers['content-length']).to.equal('5')
+      expect(response.body).to.equal('hello')
+    })
+
+    it('(Connection: close) failed upstream body does not leak upstream headers', async () => {
+      const response = await rawRequest(GATEWAY_PORT, '/http/gzip-aborted')
+
+      expect(response.statusCode).to.equal(500)
+      expect(response.headers['content-encoding']).to.equal(undefined)
+    })
+  })
+
+  describe('lambda', () => {
+    it('defaults the status code when the payload has none', async () => {
+      await request(gateway)
+        .get('/lambda-no-status-code/info')
+        .timeout(1000)
+        .expect(200)
+        .then((response) => {
+          expect(response.text).to.equal('hello')
+        })
+    })
+
+    it('defaults to 200 when neither the payload nor the invocation has a status code', async () => {
+      await request(gateway)
+        .get('/lambda-no-status/info')
+        .timeout(1000)
+        .expect(200)
+        .then((response) => {
+          expect(response.text).to.equal('no status')
+        })
+    })
+
+    it('sends an empty body when the payload has none', async () => {
+      await request(gateway)
+        .get('/lambda-no-body/info')
+        .timeout(1000)
+        .expect(204)
+    })
+
+    it('handles a null payload', () => {
+      const res = {
+        end (body) {
+          this.ended = true
+          this.body = body
+        }
+      }
+      defaultHooks.lambda.onResponse({}, res, { StatusCode: 200, Payload: 'null' })
+
+      expect(res.statusCode).to.equal(200)
+      expect(res.ended).to.equal(true)
+      expect(res.body).to.equal(undefined)
+    })
+
+    it('serializes non-string bodies', async () => {
+      await request(gateway)
+        .get('/lambda-object-body/info')
+        .timeout(1000)
+        .expect(201)
+        .then((response) => {
+          expect(response.text).to.equal('{"name":"fast-gateway"}')
+        })
+    })
+
+    it('decodes base64 encoded bodies', async () => {
+      await request(gateway)
+        .get('/lambda-base64/info')
+        .timeout(1000)
+        .buffer(true)
+        .parse(binaryParser)
+        .expect(200)
+        .then((response) => {
+          expect(response.headers['content-type']).to.equal('image/png')
+          expect(response.body.equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x00, 0xff]))).to.equal(true)
+        })
+    })
+  })
+})
diff --git a/test/hostnames-hook.test.js b/test/hostnames-hook.test.js
index d091799..fe03efc 100644
--- a/test/hostnames-hook.test.js
+++ b/test/hostnames-hook.test.js
@@ -78,4 +78,69 @@ describe('hostnames-hook', () => {
       cb()
     })
   })
+
+  it('is not match - missing host header', (cb) => {
+    const req = {
+      headers: {},
+      url: '/about'
+    }
+
+    hostnamesHook(req, null, () => {
+      expect(req.url).to.equal('/about')
+      cb()
+    })
+  })
+
+  it('is match - host header is case-insensitive', (cb) => {
+    const req = {
+      headers: {
+        host: 'NodeJS.ORG:443'
+      },
+      url: '/about'
+    }
+
+    hostnamesHook(req, null, () => {
+      expect(req.url).to.equal('/nodejs/about')
+      cb()
+    })
+  })
+
+  it('is not match - host named like an object property', () => {
+    for (const host of ['constructor', '__proto__', 'toString']) {
+      const req = {
+        headers: { host },
+        url: '/about'
+      }
+
+      hostnamesHook(req, null, () => {})
+      expect(req.url).to.equal('/about')
+    }
+  })
+
+  it('does not retain memory for each distinct matching host', () => {
+    const v8 = require('v8')
+    const vm = require('vm')
+    v8.setFlagsFromString('--expose-gc')
+    const gc = vm.runInNewContext('gc')
+
+    const hook = require('./../lib/hostnames-hook')([
+      {
+        prefix: '/users',
+        hostname: '*.company.tld'
+      }
+    ])
+    const label = 'x'.repeat(1000)
+
+    gc()
+    const heapBefore = process.memoryUsage().heapUsed
+    for (let i = 0; i < 20000; i++) {
+      hook({ headers: { host: `${label}${i}.company.tld` }, url: '/' }, null, () => {})
+    }
+    gc()
+    const retained = process.memoryUsage().heapUsed - heapBefore
+
+    // keep the hook (and anything it holds) reachable until after the measurement
+    hook({ headers: { host: 'api.company.tld' }, url: '/' }, null, () => {})
+    expect(retained).to.be.below(5 * 1024 * 1024)
+  })
 })
diff --git a/test/raw-http.js b/test/raw-http.js
new file mode 100644
index 0000000..5a33221
--- /dev/null
+++ b/test/raw-http.js
@@ -0,0 +1,41 @@
+'use strict'
+
+const net = require('net')
+
+// sends a raw HTTP/1.1 request so the request target is not normalized by the client
+module.exports = (port, path, { method = 'GET', headers = {}, timeout = 2000 } = {}) =>
+  new Promise((resolve, reject) => {
+    const socket = net.connect(port, '127.0.0.1')
+    const chunks = []
+    const lines = Object.entries({ Host: '127.0.0.1:' + port, Connection: 'close', ...headers })
+      .map(([name, value]) => `${name}: ${value}`)
+
+    const timer = setTimeout(() => {
+      socket.destroy()
+      reject(new Error('raw request timed out'))
+    }, timeout)
+
+    socket.on('connect', () => socket.write(`${method} ${path} HTTP/1.1\r\n${lines.join('\r\n')}\r\n\r\n`))
+    socket.on('data', (chunk) => chunks.push(chunk))
+    socket.on('error', (err) => {
+      clearTimeout(timer)
+      reject(err)
+    })
+    socket.on('close', () => {
+      clearTimeout(timer)
+      const data = Buffer.concat(chunks).toString()
+      const index = data.indexOf('\r\n\r\n')
+      const head = data.slice(0, index).split('\r\n')
+      const headers = {}
+      head.slice(1).forEach((line) => {
+        const separator = line.indexOf(':')
+        headers[line.slice(0, separator).trim().toLowerCase()] = line.slice(separator + 1).trim()
+      })
+
+      resolve({
+        statusCode: parseInt(head[0].split(' ')[1], 10),
+        headers,
+        body: data.slice(index + 4)
+      })
+    })
+  })
diff --git a/test/routing.test.js b/test/routing.test.js
new file mode 100644
index 0000000..ee8bdba
--- /dev/null
+++ b/test/routing.test.js
@@ -0,0 +1,691 @@
+'use strict'
+
+/* global describe, it, before, after */
+const expect = require('chai').expect
+const request = require('supertest')
+const http = require('http')
+const fastGateway = require('../index')
+const rawRequest = require('./raw-http')
+
+const UPSTREAM_PORT = 9501
+const target = `http://127.0.0.1:${UPSTREAM_PORT}`
+
+describe('routing', () => {
+  let upstream
+  const gateways = []
+  const unhandled = []
+  const onUnhandled = (reason) => unhandled.push(reason)
+
+  const start = async (opts, port) => {
+    const gateway = fastGateway(opts)
+    await gateway.start(port)
+    gateways.push(gateway)
+
+    return gateway
+  }
+
+  before(async () => {
+    process.on('unhandledRejection', onUnhandled)
+
+    upstream = http.createServer((req, res) => {
+      const reply = () => {
+        res.setHeader('content-type', 'application/json')
+        // the gateway always appends '?' when forwarding req.query, ignore it
+        res.end(JSON.stringify({
+          method: req.method,
+          url: req.url.replace(/\?$/, ''),
+          rawUrl: req.url
+        }))
+      }
+      if (req.url.startsWith('/slow')) {
+        setTimeout(reply, 300)
+      } else {
+        reply()
+      }
+    })
+    await new Promise((resolve) => upstream.listen(UPSTREAM_PORT, resolve))
+  })
+
+  after(async () => {
+    process.removeListener('unhandledRejection', onUnhandled)
+
+    for (const gateway of gateways) {
+      await gateway.close()
+    }
+    upstream.closeAllConnections()
+    await new Promise((resolve) => upstream.close(resolve))
+  })
+
+  describe('error handling', () => {
+    let gateway
+    const onErrorCalls = []
+
+    before(async () => {
+      gateway = await start({
+        routes: [
+          {
+            prefix: '/on-error-responds',
+            target,
+            hooks: {
+              async onRequest (req) {
+                throw Object.assign(new Error('unauthorized'), { status: 401 })
+              },
+              onError (err, req, res) {
+                res.statusCode = err.status
+                res.end(JSON.stringify({ error: err.message }))
+              }
+            }
+          },
+          {
+            prefix: '/partial-response',
+            target,
+            proxyHandler: (req, res) => {
+              res.writeHead(200)
+              res.write('partial')
+
+              throw new Error('failed after the response started')
+            }
+          },
+          {
+            prefix: '/partial-response-completed',
+            target,
+            proxyHandler: (req, res) => {
+              res.writeHead(200)
+              res.write('partial')
+
+              throw new Error('failed after the response started')
+            },
+            hooks: {
+              onError (_err, req, res) {
+                res.end(' completed by onError')
+              }
+            }
+          },
+          {
+            prefix: '/partial-response-on-error',
+            target,
+            proxyHandler: (req, res) => {
+              res.writeHead(200)
+              res.write('partial')
+
+              throw new Error('failed after the response started')
+            },
+            hooks: {
+              onError (err) {
+                onErrorCalls.push(err)
+              }
+            }
+          },
+          {
+            prefix: '/async-proxy-handler',
+            target,
+            proxyHandler: async () => {
+              throw new Error('proxy handler failed')
+            },
+            hooks: {
+              onError (err) {
+                onErrorCalls.push(err)
+              }
+            }
+          }
+        ]
+      }, 9502)
+    })
+
+    it('onError hook sending its own response does not trigger a second response', async () => {
+      unhandled.length = 0
+
+      await request(gateway)
+        .get('/on-error-responds/info')
+        .expect(401)
+        .then((response) => {
+          expect(JSON.parse(response.text)).to.deep.equal({ error: 'unauthorized' })
+        })
+
+      await new Promise((resolve) => setTimeout(resolve, 50))
+      expect(unhandled.map((err) => err.code)).to.deep.equal([])
+    })
+
+    it('rejecting async proxyHandler is routed to onError and answered with 500', async () => {
+      onErrorCalls.length = 0
+
+      await request(gateway)
+        .get('/async-proxy-handler/info')
+        .timeout(1000)
+        .expect(500)
+
+      expect(onErrorCalls).to.have.lengthOf(1)
+      expect(onErrorCalls[0].message).to.equal('proxy handler failed')
+    })
+
+    it('terminates a partially sent response when the handler fails', async () => {
+      // resolves once the gateway closes the connection, rejects if it hangs
+      const response = await rawRequest(9502, '/partial-response/info', { timeout: 1000 })
+
+      expect(response.body).to.not.match(/0\r\n\r\n$/)
+    })
+
+    it('keeps a partially sent response that onError completed', async () => {
+      const response = await rawRequest(9502, '/partial-response-completed/info', { timeout: 1000 })
+
+      expect(response.statusCode).to.equal(200)
+      expect(response.body).to.include('completed by onError')
+      expect(response.body).to.match(/0\r\n\r\n$/)
+    })
+
+    it('terminates a partially sent response when onError does not respond', async () => {
+      onErrorCalls.length = 0
+      const response = await rawRequest(9502, '/partial-response-on-error/info', { timeout: 1000 })
+
+      expect(response.body).to.not.match(/0\r\n\r\n$/)
+      expect(onErrorCalls).to.have.lengthOf(1)
+    })
+  })
+
+  describe('url rewriting', () => {
+    let gateway
+
+    before(async () => {
+      gateway = await start({
+        routes: [
+          { prefix: '/public', prefixRewrite: '/api/public', target },
+          { prefix: '/users', target },
+          { prefix: '/internal', prefixRewrite: '/v$&', target },
+          { prefix: '/slash', prefixRewrite: '/v2/', target },
+          { prefix: '/tenants/:tid', target },
+          { prefix: '/', target }
+        ]
+      }, 9503)
+    })
+
+    it('forwards regular paths with the prefix rewritten', async () => {
+      await request(gateway)
+        .get('/public/docs')
+        .expect(200)
+        .then((response) => {
+          expect(response.body.url).to.equal('/api/public/docs')
+        })
+    })
+
+    for (const path of [
+      '/public/../../admin/users',
+      '/public/%2e%2e/%2e%2e/admin/users',
+      '/public/.%2E/admin/users',
+      '/public/..\\..\\admin/users',
+      '/public/..;/..;/admin/users',
+      '/public/..%2f..%2fadmin/users',
+      '/public/%2e%2e%5C%2e%2e%5Cadmin/users'
+    ]) {
+      it(`rejects dot-segment traversal: ${path}`, async () => {
+        const response = await rawRequest(9503, path)
+        expect(response.statusCode).to.equal(400)
+      })
+    }
+
+    it('matches prefixes case-sensitively by default', async () => {
+      // "/Users" does not match the "/users" route, the "/" catch-all handles it
+      await request(gateway)
+        .get('/Users/42')
+        .expect(200)
+        .then((response) => {
+          expect(response.body.url).to.equal('/Users/42')
+        })
+    })
+
+    it('only strips the prefix from the beginning of the url', async () => {
+      await request(gateway)
+        .get('/users/a/users/b')
+        .expect(200)
+        .then((response) => {
+          expect(response.body.url).to.equal('/a/users/b')
+        })
+    })
+
+    it('uses prefixRewrite literally (no replacement patterns)', async () => {
+      await request(gateway)
+        .get('/internal/info')
+        .expect(200)
+        .then((response) => {
+          expect(response.body.url).to.equal('/v$&/info')
+        })
+    })
+
+    it('prefixRewrite ending with "/" does not produce a double slash', async () => {
+      await request(gateway)
+        .get('/slash/users')
+        .expect(200)
+        .then((response) => {
+          expect(response.body.url).to.equal('/v2/users')
+        })
+    })
+
+    it('forwards urls unchanged when the prefix is not literal', async () => {
+      await request(gateway)
+        .get('/tenants/42/items')
+        .expect(200)
+        .then((response) => {
+          expect(response.body.url).to.equal('/tenants/42/items')
+        })
+    })
+
+    it('"/" prefix acts as a catch-all route', async () => {
+      await request(gateway)
+        .get('/foo/bar')
+        .expect(200)
+        .then((response) => {
+          expect(response.body.url).to.equal('/foo/bar')
+        })
+    })
+  })
+
+  describe('case-insensitive routing', () => {
+    let gateway
+
+    before(async () => {
+      gateway = await start({
+        restana: { caseSensitive: false },
+        routes: [{ prefix: '/users', target }]
+      }, 9516)
+    })
+
+    it('strips the prefix case-insensitively, matching how routes are matched', async () => {
+      await request(gateway)
+        .get('/Users/42')
+        .expect(200)
+        .then((response) => {
+          expect(response.body.url).to.equal('/42')
+        })
+    })
+
+    it('only strips the prefix from the beginning of the url', async () => {
+      await request(gateway)
+        .get('/USERS/a/users/b')
+        .expect(200)
+        .then((response) => {
+          expect(response.body.url).to.equal('/a/users/b')
+        })
+    })
+  })
+
+  describe('trailing slash prefix', () => {
+    let gateway
+
+    before(async () => {
+      gateway = await start({
+        routes: [{ prefix: '/svc/', prefixRewrite: '/api', target }]
+      }, 9504)
+    })
+
+    it('matches nested paths and rewrites them', async () => {
+      await request(gateway)
+        .get('/svc/foo')
+        .expect(200)
+        .then((response) => {
+          expect(response.body.url).to.equal('/api/foo')
+        })
+    })
+  })
+
+  describe('query string', () => {
+    let gateway
+
+    before(async () => {
+      gateway = await start({
+        routes: [
+          { prefix: '/svc', target },
+          {
+            prefix: '/no-query-parser',
+            target,
+            middlewares: [
+              (req, res, next) => {
+                req.query = undefined
+                next()
+              }
+            ]
+          },
+          {
+            prefix: '/strip-token',
+            target,
+            hooks: {
+              onRequest (req) {
+                delete req.query.token
+              }
+            }
+          },
+          {
+            prefix: '/inspect',
+            target,
+            proxyHandler: (req, res, url, proxy, proxyOpts) => {
+              res.setHeader('x-page', proxyOpts.queryString.page)
+              res.setHeader('x-query', JSON.stringify({ ...proxyOpts.queryString }))
+
+              return proxy(req, res, url, proxyOpts)
+            }
+          },
+          {
+            prefix: '/set-query',
+            target,
+            hooks: {
+              onRequest (req) {
+                req.query.name = 'fast-gateway'
+              }
+            }
+          }
+        ]
+      }, 9505)
+    })
+
+    it('keeps repeated query parameters', async () => {
+      await request(gateway)
+        .get('/svc/items?a=1&a=2&b=3')
+        .expect(200)
+        .then((response) => {
+          expect(response.body.url).to.equal('/items?a=1&a=2&b=3')
+        })
+    })
+
+    it('forwards the raw query string when req.query is not available', async () => {
+      await request(gateway)
+        .get('/no-query-parser/items?a=1&a=2')
+        .expect(200)
+        .then((response) => {
+          expect(response.body.rawUrl).to.equal('/items?a=1&a=2')
+        })
+    })
+
+    it('does not append "?" when there is no query string', async () => {
+      await request(gateway)
+        .get('/svc/items')
+        .expect(200)
+        .then((response) => {
+          expect(response.body.rawUrl).to.equal('/items')
+        })
+    })
+
+    it('does not forward query parameters removed in onRequest', async () => {
+      await request(gateway)
+        .get('/strip-token/items?token=secret')
+        .expect(200)
+        .then((response) => {
+          expect(response.body.rawUrl).to.not.include('token')
+        })
+    })
+
+    it('proxyOpts.queryString stays a plain object with repeated parameters', async () => {
+      await request(gateway)
+        .get('/inspect/items?tag=a&tag=b&page=2')
+        .expect(200)
+        .then((response) => {
+          expect(response.headers['x-page']).to.equal('2')
+          expect(JSON.parse(response.headers['x-query'])).to.deep.equal({ tag: ['a', 'b'], page: '2' })
+          expect(response.body.url).to.equal('/items?tag=a&tag=b&page=2')
+        })
+    })
+
+    it('allows onRequest to set req.query when the request has no query string', async () => {
+      await request(gateway)
+        .get('/set-query/items')
+        .expect(200)
+        .then((response) => {
+          expect(response.body.url).to.equal('/items?name=fast-gateway')
+        })
+    })
+  })
+
+  describe('timeouts', () => {
+    let gateway
+
+    before(async () => {
+      gateway = await start({
+        timeout: 100,
+        routes: [
+          {
+            prefix: '/request-opts',
+            target,
+            hooks: {
+              request: { family: 4 }
+            }
+          },
+          {
+            prefix: '/disabled',
+            timeout: 0,
+            target
+          }
+        ]
+      }, 9506)
+    })
+
+    it('keeps the route timeout when hooks.request is set', async () => {
+      await request(gateway).get('/request-opts/slow').expect(504)
+    })
+
+    it('timeout: 0 disables the global timeout for a route', async () => {
+      await request(gateway).get('/disabled/slow').expect(200)
+    })
+  })
+
+  describe('route configuration objects', () => {
+    it('shared hooks object between http and lambda routes', async () => {
+      const hooks = {}
+      const gateway = await start({
+        routes: [
+          { prefix: '/http', target, hooks },
+          {
+            prefix: '/lambda',
+            proxyType: 'lambda',
+            target: 'a-lambda-function',
+            proxyConfig: {
+              lambdaProxy: (params, cb) => setImmediate(() => cb(null, {
+                StatusCode: 200,
+                Payload: JSON.stringify({ statusCode: 200, body: 'from lambda' })
+              }))
+            },
+            hooks
+          }
+        ]
+      }, 9507)
+
+      await request(gateway)
+        .get('/http/info')
+        .expect(200)
+        .then((response) => {
+          expect(response.body.url).to.equal('/info')
+        })
+
+      await request(gateway)
+        .get('/lambda/info')
+        .timeout(1000)
+        .expect(200)
+        .then((response) => {
+          expect(response.text).to.equal('from lambda')
+        })
+
+      expect(hooks).to.deep.equal({})
+    })
+
+    it('reusing routes for another gateway does not leak settings', async () => {
+      const routes = [{ prefix: '/svc', target }]
+      await start({ timeout: 100, routes }, 9508)
+      const gateway = await start({ routes }, 9509)
+
+      await request(gateway).get('/svc/slow').expect(200)
+    })
+
+    it('supports the documented "http-legacy" proxy type', async () => {
+      const fastProxyLite = require('fast-proxy-lite')
+      const gateway = await start({
+        proxyFactory: ({ proxyType, route }) => {
+          if (proxyType === 'http-legacy') {
+            return fastProxyLite({ base: route.target }).proxy
+          }
+        },
+        routes: [{ prefix: '/legacy', proxyType: 'http-legacy', target }]
+      }, 9510)
+
+      await request(gateway)
+        .get('/legacy/info')
+        .timeout(1000)
+        .expect(200)
+        .then((response) => {
+          expect(response.body.url).to.equal('/info')
+        })
+
+      expect(() => fastGateway({
+        routes: [{ prefix: '/legacy', proxyType: 'http-legacy', target }]
+      })).to.not.throw(/Unsupported proxy type/)
+    })
+
+    it('passes req.query unchanged to non "http" proxy types', async () => {
+      const gateway = await start({
+        proxyFactory: () => () => {},
+        routes: [
+          {
+            prefix: '/legacy',
+            proxyType: 'http-legacy',
+            target,
+            proxyHandler: (req, res, url, proxy, proxyOpts) => {
+              res.setHeader('content-type', 'application/json')
+              res.end(JSON.stringify({
+                isURLSearchParams: proxyOpts.queryString instanceof URLSearchParams,
+                queryString: proxyOpts.queryString
+              }))
+            }
+          }
+        ]
+      }, 9512)
+
+      await request(gateway)
+        .get('/legacy/items?a=1&a=2&b=3')
+        .expect(200)
+        .then((response) => {
+          expect(response.body).to.deep.equal({
+            isURLSearchParams: false,
+            queryString: { a: ['1', '2'], b: '3' }
+          })
+        })
+    })
+
+    it('does not crash on a non-string pathRegex', () => {
+      expect(() => fastGateway({
+        pathRegex: undefined,
+        routes: [{ prefix: '/api/', target }]
+      })).to.not.throw()
+    })
+
+    it('creates "http-legacy" proxies using fast-proxy', async () => {
+      // fast-proxy is an optional dependency, stand in for it with fast-proxy-lite
+      const Module = require('module')
+      const resolveFilename = Module._resolveFilename
+      const fastProxyLite = require('fast-proxy-lite')
+      const configs = []
+      Module._resolveFilename = function (request, ...args) {
+        return request === 'fast-proxy'
+          ? 'fast-proxy'
+          : resolveFilename.call(this, request, ...args)
+      }
+      require.cache['fast-proxy'] = {
+        id: 'fast-proxy',
+        filename: 'fast-proxy',
+        loaded: true,
+        exports: (config) => {
+          configs.push(config)
+
+          return fastProxyLite(config)
+        }
+      }
+
+      try {
+        const gateway = await start({
+          routes: [
+            {
+              prefix: '/legacy',
+              proxyType: 'http-legacy',
+              target,
+              proxyConfig: { cacheURLs: 0 }
+            }
+          ]
+        }, 9513)
+
+        await request(gateway)
+          .get('/legacy/info?a=1&a=2')
+          .expect(200)
+          .then((response) => {
+            expect(response.body.url).to.equal('/info?a=1&a=2')
+          })
+        expect(configs).to.deep.equal([{ base: target, cacheURLs: 0 }])
+      } finally {
+        Module._resolveFilename = resolveFilename
+        delete require.cache['fast-proxy']
+      }
+    })
+
+    it('uses the default proxy factory when proxyFactory returns undefined', async () => {
+      const gateway = await start({
+        proxyFactory: () => undefined,
+        routes: [{ prefix: '/svc', target }]
+      }, 9514)
+
+      await request(gateway)
+        .get('/svc/info')
+        .expect(200)
+        .then((response) => {
+          expect(response.body.url).to.equal('/info')
+        })
+    })
+
+    it('supports custom proxy types created by proxyFactory', async () => {
+      const gateway = await start({
+        proxyFactory: ({ proxyType }) => {
+          if (proxyType === 'custom') {
+            return (req, res, url) => res.end('custom proxy: ' + url)
+          }
+        },
+        routes: [{ prefix: '/custom', proxyType: 'custom', target }]
+      }, 9515)
+
+      await request(gateway)
+        .get('/custom/items')
+        .expect(200)
+        .then((response) => {
+          expect(response.text).to.equal('custom proxy: /items')
+        })
+    })
+
+    it('rejects unsupported proxy types', () => {
+      const routes = [{ prefix: '/svc', proxyType: 'unknown', target }]
+
+      expect(() => fastGateway({ routes })).to.throw(
+        'Unsupported proxy type, expecting one of http,http-legacy,lambda'
+      )
+      expect(() => fastGateway({ proxyFactory: () => undefined, routes })).to.throw(
+        'Unsupported proxy type: unknown!'
+      )
+    })
+
+    it('requires getServer() on custom servers for websocket routes', () => {
+      expect(() => fastGateway({
+        server: require('express')(),
+        routes: [{ proxyType: 'websocket', prefix: '/ws', target: 'ws://127.0.0.1:1' }]
+      })).to.throw(/Unable to retrieve the HTTP server instance/)
+    })
+
+    it('ignores methods the server does not support', () => {
+      expect(() => fastGateway({
+        routes: [{ prefix: '/svc', methods: ['TRACE'], target }]
+      })).to.not.throw()
+    })
+
+    it('services.json describes RegExp prefixes', async () => {
+      const gateway = await start({
+        routes: [{ prefix: /\/regex\/.*/, target }]
+      }, 9511)
+
+      await request(gateway)
+        .get('/services.json')
+        .expect(200)
+        .then((response) => {
+          expect(response.body).to.deep.equal([{ prefix: '/\\/regex\\/.*/' }])
+        })
+    })
+  })
+})
diff --git a/test/smoke.test.js b/test/smoke.test.js
index 6d36d3c..b99fc52 100644
--- a/test/smoke.test.js
+++ b/test/smoke.test.js
@@ -376,11 +376,20 @@ describe('API Gateway', () => {
       })
   })
 
-  it('large chunked rejected with 502 when Connection close (buffer limit)', async () => {
+  it('large chunked streamed when Connection close (above buffer limit)', async () => {
     await request(gateway)
       .get('/users/large-chunked')
       .set({ Connection: 'close' })
-      .expect(502)
+      .buffer(true)
+      .parse((res, cb) => {
+        let length = 0
+        res.on('data', (chunk) => { length += chunk.length })
+        res.on('end', () => cb(null, length))
+      })
+      .expect(200)
+      .then((response) => {
+        expect(response.body).to.equal(2 * 1024 * 1024)
+      })
   })
 
   it('large chunked streamed normally when Connection keep-alive', async () => {
diff --git a/test/ws-proxy-bugs.test.js b/test/ws-proxy-bugs.test.js
new file mode 100644
index 0000000..1de5b09
--- /dev/null
+++ b/test/ws-proxy-bugs.test.js
@@ -0,0 +1,404 @@
+'use strict'
+
+/* global describe, it, before, after */
+const expect = require('chai').expect
+const gateway = require('../index')
+const WebSocket = require('faye-websocket')
+const http = require('http')
+const net = require('net')
+const crypto = require('crypto')
+
+const GW_PORT = 9300
+const UPSTREAM_PORT = 9301
+const SHARED_GW_PORT = 9302
+const CONFIG_GW_PORT = 9303
+const MULTI_LISTENER_GW_PORT = 9304
+const DEAD_PORT = 9399
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+
+const waitFor = async (predicate, timeout = 1000) => {
+  const deadline = Date.now() + timeout
+  while (!predicate()) {
+    if (Date.now() > deadline) return false
+    await sleep(10)
+  }
+  return true
+}
+
+const trackSockets = (server) => {
+  const sockets = new Set()
+  server.on('connection', (socket) => {
+    sockets.add(socket)
+    socket.on('close', () => sockets.delete(socket))
+  })
+  return sockets
+}
+
+const closeServer = async (server, sockets) => {
+  sockets.forEach((socket) => socket.destroy())
+  await Promise.race([new Promise((resolve) => server.close(resolve)), sleep(500)])
+}
+
+const nextClose = (ws) => new Promise((resolve) => ws.on('close', resolve))
+
+const nextMessage = (ws) => new Promise((resolve) => {
+  ws.on('message', (event) => resolve(JSON.parse(event.data)))
+})
+
+const rawUpgrade = (path, headers) => new Promise((resolve) => {
+  const socket = net.connect(GW_PORT, '127.0.0.1', () => {
+    socket.write(`GET ${path} HTTP/1.1\r\nHost: 127.0.0.1:${GW_PORT}\r\n${headers}\r\n`)
+  })
+  socket.on('error', () => {})
+  resolve(socket)
+})
+
+const wsUpgradeHeaders = (version = 13) =>
+  'Upgrade: websocket\r\nConnection: Upgrade\r\n' +
+  `Sec-WebSocket-Key: ${crypto.randomBytes(16).toString('base64')}\r\n` +
+  `Sec-WebSocket-Version: ${version}\r\n`
+
+const failingHook = (code, message) => () => {
+  const err = new Error(message)
+  err.closeEventCode = code
+
+  throw err
+}
+
+describe('ws-proxy regressions', function () {
+  this.timeout(5000)
+
+  let gw, upstream, upstreamSockets, gwSockets
+  const state = { upgrades: 0, open: new Set(), closes: [] }
+
+  before(async () => {
+    upstream = http.createServer()
+    upstreamSockets = trackSockets(upstream)
+    upstream.on('upgrade', (req, socket, body) => {
+      state.upgrades++
+      state.open.add(socket)
+      socket.on('close', () => state.open.delete(socket))
+
+      const ws = new WebSocket(req, socket, body, ['graphql-ws', 'graphql-transport-ws'])
+      ws.on('message', (event) => {
+        if (event.data === 'kick') return ws.close(4001, 'kicked')
+        if (event.data === 'crash') return socket.destroy()
+        ws.send(JSON.stringify({ data: event.data, url: req.url, protocol: ws.protocol }))
+      })
+      ws.on('close', (event) => state.closes.push({ code: event.code, reason: event.reason }))
+    })
+    await new Promise((resolve) => upstream.listen(UPSTREAM_PORT, '127.0.0.1', resolve))
+
+    const target = `ws://127.0.0.1:${UPSTREAM_PORT}`
+    gw = gateway({
+      routes: [
+        { proxyType: 'websocket', prefix: '/echo', target },
+        { proxyType: 'websocket', prefix: '/down', target: `ws://127.0.0.1:${DEAD_PORT}` },
+        {
+          proxyType: 'websocket',
+          prefix: '/slow',
+          target,
+          hooks: { onOpen: () => sleep(150) }
+        },
+        {
+          proxyType: 'websocket',
+          prefix: '/sync-auth',
+          target,
+          hooks: { onOpen: failingHook(4401, 'Unauthorized') }
+        },
+        {
+          proxyType: 'websocket',
+          prefix: '/long-reason',
+          target,
+          hooks: { onOpen: failingHook(4401, 'Unauthorized: ' + 'x'.repeat(200)) }
+        },
+        {
+          proxyType: 'websocket',
+          prefix: '/broken-hooks',
+          target,
+          hooks: {
+            get onOpen () {
+              throw new Error('broken route config')
+            }
+          }
+        },
+        {
+          proxyType: 'websocket',
+          prefix: '/emoji-reason',
+          target,
+          hooks: { onOpen: failingHook(4401, 'a'.repeat(120) + '\u{1F600}') }
+        },
+        {
+          proxyType: 'websocket',
+          prefix: '/invalid-code',
+          target,
+          hooks: { onOpen: failingHook(1008, 'Policy violation') }
+        },
+        {
+          proxyType: 'websocket',
+          prefix: '/reject-undefined',
+          target,
+          hooks: { onOpen: () => Promise.reject() } // eslint-disable-line prefer-promise-reject-errors
+        },
+        {
+          proxyType: 'websocket',
+          prefix: '/graphql',
+          target,
+          subProtocols: ['graphql-ws', 'graphql-transport-ws']
+        }
+      ]
+    })
+    gwSockets = trackSockets(gw.getServer())
+    await gw.start(GW_PORT)
+  })
+
+  after(async () => {
+    await closeServer(gw.getServer(), gwSockets)
+    await closeServer(upstream, upstreamSockets)
+  })
+
+  it('closes the client when the upstream is unreachable', async () => {
+    const ws = new WebSocket.Client(`ws://127.0.0.1:${GW_PORT}/down`)
+    const closed = await Promise.race([nextClose(ws), sleep(1500)])
+
+    expect(closed, 'client socket left open').to.not.equal(undefined)
+  })
+
+  it('closes the upstream when the client connection is reset', async () => {
+    const before = state.upgrades
+    const socket = await rawUpgrade('/echo', wsUpgradeHeaders())
+    expect(await waitFor(() => state.upgrades === before + 1 && state.open.size === 1)).to.equal(true)
+
+    socket.resetAndDestroy()
+
+    expect(await waitFor(() => state.open.size === 0), 'upstream connection leaked').to.equal(true)
+  })
+
+  it('propagates close codes and reasons in both directions', async () => {
+    const kicked = new WebSocket.Client(`ws://127.0.0.1:${GW_PORT}/echo`)
+    kicked.on('open', () => kicked.send('kick'))
+    const event = await nextClose(kicked)
+    expect([event.code, event.reason]).to.deep.equal([4001, 'kicked'])
+
+    const leaving = new WebSocket.Client(`ws://127.0.0.1:${GW_PORT}/echo`)
+    await new Promise((resolve) => leaving.on('open', resolve))
+    await waitFor(() => state.open.size === 1)
+    state.closes.length = 0
+    leaving.close(4000, 'bye')
+
+    expect(await waitFor(() => state.closes.length === 1)).to.equal(true)
+    expect(state.closes[0]).to.deep.equal({ code: 4000, reason: 'bye' })
+  })
+
+  it('reports an abnormal upstream close to the client as abnormal', async () => {
+    const ws = new WebSocket.Client(`ws://127.0.0.1:${GW_PORT}/echo`)
+    ws.on('open', () => ws.send('crash'))
+    const event = await nextClose(ws)
+
+    expect(event.code).to.equal(1006)
+  })
+
+  it('drops the connection on unexpected errors instead of crashing', async () => {
+    const before = state.upgrades
+    const ws = new WebSocket.Client(`ws://127.0.0.1:${GW_PORT}/broken-hooks`)
+    const event = await nextClose(ws)
+
+    expect(event.code).to.equal(1006)
+    expect(state.upgrades).to.equal(before)
+  })
+
+  it('truncates long close reasons on a character boundary', async () => {
+    const ws = new WebSocket.Client(`ws://127.0.0.1:${GW_PORT}/emoji-reason`)
+    const event = await nextClose(ws)
+
+    expect(event.code).to.equal(4401)
+    expect(event.reason).to.equal('a'.repeat(120))
+  })
+
+  it('ends upgrades no listener handles when the server has other upgrade listeners', async () => {
+    const multi = gateway({
+      enableServicesEndpoint: false,
+      routes: [{ proxyType: 'websocket', prefix: '/proxied', target: `ws://127.0.0.1:${UPSTREAM_PORT}` }]
+    })
+    const server = multi.getServer()
+    const sockets = trackSockets(server)
+    server.on('upgrade', () => {}) // e.g. another library ignoring paths it doesn't own
+    await multi.start(MULTI_LISTENER_GW_PORT)
+
+    try {
+      const socket = net.connect(MULTI_LISTENER_GW_PORT, '127.0.0.1', () => {
+        socket.write(`GET /unknown HTTP/1.1\r\nHost: 127.0.0.1:${MULTI_LISTENER_GW_PORT}\r\n${wsUpgradeHeaders()}\r\n`)
+      })
+      socket.on('error', () => {})
+      const closed = await Promise.race([
+        new Promise((resolve) => socket.on('close', () => resolve(true))),
+        sleep(2000)
+      ])
+      socket.destroy()
+
+      expect(closed, 'unhandled upgrade socket left open').to.equal(true)
+    } finally {
+      await closeServer(server, sockets)
+    }
+  })
+
+  it('does not lose messages sent while an async onOpen hook is pending', async () => {
+    const ws = new WebSocket.Client(`ws://127.0.0.1:${GW_PORT}/slow`)
+    ws.on('open', () => ws.send('first'))
+    const reply = await Promise.race([nextMessage(ws), sleep(1000)])
+    ws.close()
+
+    expect(reply, 'message lost').to.not.equal(undefined)
+    expect(reply.data).to.equal('first')
+  })
+
+  it('bounds the messages queued while an async onOpen hook is pending', async () => {
+    const before = state.upgrades
+    const ws = new WebSocket.Client(`ws://127.0.0.1:${GW_PORT}/slow`)
+    ws.on('open', () => {
+      for (let i = 0; i < 3; i++) ws.send(Buffer.alloc(512 * 1024))
+    })
+    const closed = await Promise.race([nextClose(ws), sleep(1000)])
+
+    expect(closed, 'client socket left open').to.not.equal(undefined)
+    expect(closed.code).to.equal(4413)
+    await sleep(200)
+    expect(state.upgrades).to.equal(before)
+  })
+
+  it('does not mutate websocket route configs', async () => {
+    const route = { proxyType: 'websocket', prefix: '/echo', target: `ws://127.0.0.1:${UPSTREAM_PORT}` }
+    const configGw = gateway({ routes: [route] })
+    const configGwSockets = trackSockets(configGw.getServer())
+    await configGw.start(CONFIG_GW_PORT)
+
+    const ws = new WebSocket.Client(`ws://127.0.0.1:${CONFIG_GW_PORT}/echo`)
+    await new Promise((resolve) => ws.on('open', resolve))
+    ws.close()
+    await nextClose(ws)
+    await closeServer(configGw.getServer(), configGwSockets)
+
+    expect(route).to.deep.equal({
+      proxyType: 'websocket',
+      prefix: '/echo',
+      target: `ws://127.0.0.1:${UPSTREAM_PORT}`
+    })
+  })
+
+  it('does not open an upstream connection when the client left during onOpen', async () => {
+    const before = state.upgrades
+    const ws = new WebSocket.Client(`ws://127.0.0.1:${GW_PORT}/slow`)
+    ws.on('open', () => ws.close())
+    await nextClose(ws)
+    await sleep(300)
+
+    expect(state.upgrades).to.equal(before)
+  })
+
+  it('does not open an upstream connection for a rejected client handshake', async () => {
+    const before = state.upgrades
+    const socket = await rawUpgrade('/echo', wsUpgradeHeaders(99))
+    let response = ''
+    socket.on('data', (chunk) => { response += chunk })
+    await new Promise((resolve) => socket.on('close', resolve))
+    await sleep(200)
+
+    expect(response).to.match(/^HTTP\/1\.1 400/)
+    expect(state.upgrades).to.equal(before)
+  })
+
+  it('survives onOpen errors with invalid close codes or non-Error rejections', async () => {
+    const rejections = []
+    const onRejection = (reason) => rejections.push(reason)
+    process.on('unhandledRejection', onRejection)
+
+    try {
+      for (const path of ['/invalid-code', '/reject-undefined']) {
+        const ws = new WebSocket.Client(`ws://127.0.0.1:${GW_PORT}${path}`)
+        const event = await Promise.race([nextClose(ws), sleep(1000)])
+
+        expect(event, `${path}: client socket left open`).to.not.equal(undefined)
+        expect(event.code).to.equal(4500)
+      }
+      expect(rejections).to.have.lengthOf(0)
+    } finally {
+      process.removeListener('unhandledRejection', onRejection)
+    }
+  })
+
+  it('delivers the onOpen close code when the hook throws synchronously', async () => {
+    const ws = new WebSocket.Client(`ws://127.0.0.1:${GW_PORT}/sync-auth`)
+    const event = await nextClose(ws)
+    expect([event.code, event.reason]).to.deep.equal([4401, 'Unauthorized'])
+
+    const long = new WebSocket.Client(`ws://127.0.0.1:${GW_PORT}/long-reason`)
+    const longEvent = await nextClose(long)
+    expect(longEvent.code).to.equal(4401)
+    expect(longEvent.reason.startsWith('Unauthorized: xxx')).to.equal(true)
+  })
+
+  it('does not hang non-WebSocket upgrade requests', async () => {
+    const socket = await rawUpgrade(
+      '/svc/hello',
+      'Connection: Upgrade, HTTP2-Settings\r\nUpgrade: h2c\r\nHTTP2-Settings: AAMAAABkAAQAoAAAAAIAAAAA\r\n'
+    )
+    const closed = await Promise.race([
+      new Promise((resolve) => socket.on('close', () => resolve(true))),
+      sleep(1000)
+    ])
+    socket.destroy()
+
+    expect(closed, 'socket left hanging').to.equal(true)
+  })
+
+  it('leaves unmatched upgrades to other upgrade listeners on the same server', async () => {
+    const shared = gateway({
+      enableServicesEndpoint: false,
+      routes: [{ proxyType: 'websocket', prefix: '/proxied', target: `ws://127.0.0.1:${UPSTREAM_PORT}` }]
+    })
+    const server = shared.getServer()
+    const sockets = trackSockets(server)
+    server.on('upgrade', (req, socket, body) => {
+      if (req.url === '/local') {
+        const ws = new WebSocket(req, socket, body)
+        ws.on('message', (event) => ws.send(JSON.stringify({ data: 'local:' + event.data })))
+      }
+    })
+    await shared.start(SHARED_GW_PORT)
+
+    try {
+      for (const [path, expected] of [['/local', 'local:ping'], ['/proxied', 'ping']]) {
+        const ws = new WebSocket.Client(`ws://127.0.0.1:${SHARED_GW_PORT}${path}`)
+        ws.on('open', () => ws.send('ping'))
+        const reply = await Promise.race([nextMessage(ws), nextClose(ws), sleep(1000)])
+        ws.close()
+
+        expect(reply && reply.data, path).to.equal(expected)
+      }
+    } finally {
+      await closeServer(server, sockets)
+    }
+  })
+
+  it('offers upstream only the subprotocol negotiated with the client', async () => {
+    const ws = new WebSocket.Client(`ws://127.0.0.1:${GW_PORT}/graphql`, ['graphql-transport-ws'])
+    ws.on('open', () => ws.send('init'))
+    const reply = await nextMessage(ws)
+    ws.close()
+
+    expect(ws.protocol).to.equal('graphql-transport-ws')
+    expect(reply.protocol).to.equal('graphql-transport-ws')
+  })
+
+  it('forwards the query string unchanged', async () => {
+    for (const path of ['/echo', '/echo?q=a%20b&path=a/b&sig=x~y']) {
+      const ws = new WebSocket.Client(`ws://127.0.0.1:${GW_PORT}${path}`)
+      ws.on('open', () => ws.send('x'))
+      const reply = await nextMessage(ws)
+      ws.close()
+
+      expect(reply.url).to.equal(path)
+    }
+  })
+})