I would recommend (if any NPM people are reading this) that the error for an unknown Host header be changed to 404. Bad host headers are already filtered out by Cloudflare (which returns 400), so any host headers that make it through would represent "unknown"/"missing" hosts (hence 404).