…ily blocking. Many programs do not handle non-blocking stdio very well. In particular, man and less have serious problems with this, and since stdout isn't being flushed after each write, the output jumps about on the screen as you page down. Programs that do use non-blocking stdio will set that flag themselves (as node does). This puts the stdio file descriptors into blocking mode before sharing them with the child process, so that one could spawn a vim subprocess, or some other program that depends on blocking IO.
… when the client setup failed.
Any path.join or path.normalize that starts with a / will not go "above" that after normalization. This is important because /../foo is almost *always* some sort of error, and doesn't match the corollary in sh: `cd $p; pwd` At the worse, this can be a vector for exploits, since a static file server might do path.join(docroot, path.normalize("/"+req)) to get the file. If the normalized request path could be something like "/../../../etc/passwd" then bad things could happen.
Stops Valgrind from complaining about uninitialized memory access.