The firewall was innocent. The reporter's package.json had an `overrides` section (added by an automated security-scan fix) forcing `raw-body@<4.0.0` to `4.0.0`, which changed raw-body's export from a plain function to `{ __esModule, default, getRawBody, ... }` and broke body-parser 2.3.0's `require('raw-body')` call. Removing the override restored raw-body 3.0.2 and everything worked. Lesson: when an instrumenting library seems to break a transitive dependency, check your `overrides`/`resolutions` first. Forced major-version bumps on shared transitive deps (raw-body, qs, debug) break the libraries that consume them, and the blame lands on whatever was installed last.