diff --git a/mighttpd2.cabal b/mighttpd2.cabal
--- a/mighttpd2.cabal
+++ b/mighttpd2.cabal
@@ -1,5 +1,5 @@
 Name:                   mighttpd2
-Version:                3.3.4
+Version:                3.3.5
 Author:                 Kazu Yamamoto <kazu@iij.ad.jp>
 Maintainer:             Kazu Yamamoto <kazu@iij.ad.jp>
 License:                BSD3
diff --git a/src/WaiApp.hs b/src/WaiApp.hs
--- a/src/WaiApp.hs
+++ b/src/WaiApp.hs
@@ -3,8 +3,8 @@
 module WaiApp (fileCgiApp) where
 
 import Data.ByteString (ByteString)
-import qualified Data.ByteString.Char8 as BS (isPrefixOf, length)
-import Network.HTTP.Types (preconditionFailed412, movedPermanently301, urlDecode)
+import qualified Data.ByteString.Char8 as BS
+import Network.HTTP.Types (preconditionFailed412, movedPermanently301, urlDecode, badRequest400)
 import Network.Wai (Application, responseLBS)
 import Network.Wai.Internal
 import Network.Wai.Application.Classic
@@ -15,7 +15,11 @@
 
 fileCgiApp :: ClassicAppSpec -> FileAppSpec -> CgiAppSpec -> RevProxyAppSpec
            -> RouteDBRef -> Application
-fileCgiApp cspec filespec cgispec revproxyspec rdr req respond = do
+fileCgiApp cspec filespec cgispec revproxyspec rdr req respond
+  | dotFile = do
+        let st = badRequest400
+        fastResponse respond st defaultHeader "Bad Request\r\n"
+  | otherwise = do
     um <- readRouteDBRef rdr
     case mmp um of
         Fail -> do
@@ -35,7 +39,9 @@
             revProxyApp cspec revproxyspec (RevProxyRoute src dst dom prt) req respond
   where
     (host, _) = hostPort req
-    path = urlDecode False $ rawPathInfo req
+    rawpath = rawPathInfo req
+    path = urlDecode False rawpath
+    dotFile = BS.isPrefixOf "." rawpath || BS.isInfixOf "/." rawpath
     mmp um = case getBlock host um of
         Nothing  -> Fail
         Just blk -> getRoute path blk