diff --git a/lib/cartodb/api/map/preview-layergroup-controller.js b/lib/cartodb/api/map/preview-layergroup-controller.js
index 9e84f8d9..975d3f56 100644
--- a/lib/cartodb/api/map/preview-layergroup-controller.js
+++ b/lib/cartodb/api/map/preview-layergroup-controller.js
@@ -12,6 +12,7 @@ const cacheControlHeader = require('../middlewares/cache-control-header');
 const cacheChannelHeader = require('../middlewares/cache-channel-header');
 const surrogateKeyHeader = require('../middlewares/surrogate-key-header');
 const lastModifiedHeader = require('../middlewares/last-modified-header');
+const checkStaticImageFormat = require('../middlewares/check-static-image-format');
 
 module.exports = class PreviewLayergroupController {
     constructor (
@@ -65,6 +66,7 @@ module.exports = class PreviewLayergroupController {
             dbConnSetup(this.pgConnection),
             rateLimit(this.userLimitsBackend, RATE_LIMIT_ENDPOINTS_GROUPS.STATIC),
             cleanUpQueryParams(['layer']),
+            checkStaticImageFormat(),
             createMapStoreMapConfigProvider(
                 this.mapStore,
                 this.userLimitsBackend,
diff --git a/lib/cartodb/api/map/preview-template-controller.js b/lib/cartodb/api/map/preview-template-controller.js
index 385b954d..321bb882 100644
--- a/lib/cartodb/api/map/preview-template-controller.js
+++ b/lib/cartodb/api/map/preview-template-controller.js
@@ -7,6 +7,7 @@ const cacheControlHeader = require('../middlewares/cache-control-header');
 const cacheChannelHeader = require('../middlewares/cache-channel-header');
 const surrogateKeyHeader = require('../middlewares/surrogate-key-header');
 const lastModifiedHeader = require('../middlewares/last-modified-header');
+const checkStaticImageFormat = require('../middlewares/check-static-image-format');
 const rateLimit = require('../middlewares/rate-limit');
 const { RATE_LIMIT_ENDPOINTS_GROUPS } = rateLimit;
 
@@ -54,6 +55,7 @@ module.exports = class PreviewTemplateController {
             dbConnSetup(this.pgConnection),
             rateLimit(this.userLimitsBackend, RATE_LIMIT_ENDPOINTS_GROUPS.STATIC_NAMED),
             cleanUpQueryParams(['layer', 'zoom', 'lon', 'lat', 'bbox']),
+            checkStaticImageFormat(),
             namedMapProvider({
                 namedMapProviderCache: this.namedMapProviderCache,
                 label: 'STATIC_VIZ_MAP', forcedFormat: 'png'
diff --git a/lib/cartodb/api/middlewares/check-static-image-format.js b/lib/cartodb/api/middlewares/check-static-image-format.js
new file mode 100644
index 00000000..9b9c8b24
--- /dev/null
+++ b/lib/cartodb/api/middlewares/check-static-image-format.js
@@ -0,0 +1,11 @@
+const VALID_IMAGE_FORMATS = ['png', 'jpg'];
+
+module.exports = function checkStaticImageFormat () {
+    return function checkStaticImageFormatMiddleware (req, res, next) {
+        if(!VALID_IMAGE_FORMATS.includes(req.params.format)) {
+            return next(new Error(`Unsupported image format "${req.params.format}"`));
+        }
+
+        next();
+    };
+};
diff --git a/test/acceptance/analysis/named-maps.js b/test/acceptance/analysis/named-maps.js
index 42fb19d0..98316d2d 100644
--- a/test/acceptance/analysis/named-maps.js
+++ b/test/acceptance/analysis/named-maps.js
@@ -261,6 +261,41 @@ describe('named-maps analysis', function() {
             );
         });
 
+        it('should return and an error requesting unsupported image format', function(done) {
+            assert.response(
+                server,
+                {
+                    url: '/api/v1/map/static/center/' + layergroupid + '/4/42/-3/320/240.gif',
+                    method: 'GET',
+                    encoding: 'binary',
+                    headers: {
+                        host: username
+                    }
+                },
+                {
+                    status: 400,
+                    headers: {
+                        'Content-Type': 'application/json; charset=utf-8'
+                    }
+                },
+                function(res, err) {
+                    assert.ifError(err);
+                    assert.deepEqual(
+                        JSON.parse(res.body),
+                        {
+                            errors:['Unsupported image format \"gif\"'],
+                            errors_with_context:[{
+                                type: 'unknown',
+                                message: 'Unsupported image format \"gif\"'
+                            }]
+                        }
+                    );
+                    done();
+
+                }
+            );
+        });
+
     });
 
     describe('auto-instantiation', function() {
diff --git a/test/acceptance/named_maps_static_view.js b/test/acceptance/named_maps_static_view.js
index 9844c667..69c4e56c 100644
--- a/test/acceptance/named_maps_static_view.js
+++ b/test/acceptance/named_maps_static_view.js
@@ -282,4 +282,57 @@ describe('named maps static view', function() {
         });
     });
 
+    it('should return an error requesting unsupported image format', function (done) {
+        var view = {
+            zoom: 4,
+            center: {
+                lng: 40,
+                lat: 20
+            }
+        };
+
+        templateMaps.addTemplate(username, createTemplate(view), function (err) {
+            if (err) {
+                return done(err);
+            }
+            
+            var url = `/api/v1/map/static/named/${templateName}/640/480.gif`;
+
+            
+            var requestOptions = {
+                url: url,
+                method: 'GET',
+                headers: {
+                    host: username
+                },
+                encoding: 'binary'
+            };
+
+            var expectedResponse = {
+                status: 400,
+                headers: {
+                    'Content-Type': 'application/json; charset=utf-8'
+                }
+            };
+
+            // this could be removed once named maps are invalidated, otherwise you hits the cache
+            var server = new CartodbWindshaft(serverOptions);
+
+            assert.response(server, requestOptions, expectedResponse, function (res, err) {
+                assert.ifError(err);
+                assert.deepEqual(
+                    JSON.parse(res.body),
+                    {
+                        errors:['Unsupported image format \"gif\"'],
+                        errors_with_context:[{
+                            type: 'unknown',
+                            message: 'Unsupported image format \"gif\"'
+                        }]
+                    }
+                );
+                done();
+            });
+        });
+    });
+
 });