diff --git a/packages/api/session-controller/src/media-references.ts b/packages/api/session-controller/src/media-references.ts
index 7d106f02d7..42e225cbdc 100644
--- a/packages/api/session-controller/src/media-references.ts
+++ b/packages/api/session-controller/src/media-references.ts
@@ -126,20 +126,16 @@ export async function serveMediaReference(
   }
   if (registry === undefined) return new Response('file serving is unavailable', { status: 403 })
   let canonical: string
+  let info
   try {
     canonical = await realpath(path)
+    info = await stat(canonical)
   } catch {
     return new Response('not found', { status: 404 })
   }
   const insideWorkspace = registry.list().some(root =>
     canonical === root.path || canonical.startsWith(root.path + sep))
   if (!insideWorkspace) return new Response('outside workspace roots', { status: 403 })
-  let info
-  try {
-    info = await stat(canonical)
-  } catch {
-    return new Response('not found', { status: 404 })
-  }
   if (!info.isFile()) return new Response('not a regular file', { status: 403 })
   const mediaType = mediaTypeForPath(canonical)
   if (mediaType === undefined) {
diff --git a/packages/api/session-controller/tests/media-references.host.spec.ts b/packages/api/session-controller/tests/media-references.host.spec.ts
index 0c58d9b256..e6d39446d9 100644
--- a/packages/api/session-controller/tests/media-references.host.spec.ts
+++ b/packages/api/session-controller/tests/media-references.host.spec.ts
@@ -55,6 +55,8 @@ describe('parseByteRange', () => {
 
   it('refuses malformed and unsatisfiable ranges', () => {
     expect(parseByteRange('bytes=abc', 100)).toBeUndefined()
+    expect(parseByteRange('bytes=-', 100)).toBeUndefined()
+    expect(parseByteRange('bytes=-0', 100)).toBeUndefined()
     expect(parseByteRange('bytes=5-2', 100)).toBeUndefined()
     expect(parseByteRange('bytes=100-', 100)).toBeUndefined()
     expect(parseByteRange('bytes=0-', 0)).toBeUndefined()