diff --git a/lib/server/index.js b/lib/server/index.js
index dfb59269f..bdefacd3b 100644
--- a/lib/server/index.js
+++ b/lib/server/index.js
@@ -157,7 +157,7 @@ class Server extends EventEmitter {
       if (err) {
         log.error(err.message);
         if (err.code === 'ENOENT') {
-          res.status(404).send(`Not found: ${req.url}`);
+          res.status(404).send(`Not found: ${req.url.replace(/&/g,'&amp;').replace(/</g,'&lt;')}`);
         } else {
           res.status(500).send(err.message);
         }