'throw' from within bsync.compare crashes node?

Okay. I'm sure this is going to come off as obvious and noobish. But I've only been having a go at learning express/node/react for a month or so now.

I'm just trying to make a simple node signin API call. Here's a snippet of code, with some pseudo-izing of the unimportant parts for brevity:

server.post('/signin', (request, response) => {
    const {user_email, password} = request.body

    // query db for user validation
    db('user_login')
    /* knex query building, blah blah blah */
    .then(res => {
        if (res.length == 0) {
            // if res.length == 0, user not found
            throw new Error("bad credentials")
        } else if (res.length > 1) {
            // if res.length > 1, duplicate user found - shouldn't ever happen
            throw new Error("CRITICAL: database error")
        } else {
            // everything should be ok - pass res on to bcrypt
            return res
        }
    })
    .then(res => {
        // bcrypt.compare doesn't return a promise because it is being given a cb
        bcrypt.compare(password, res[0].pw_hash, (err, match) => {
            if (match) {
                // delete pw_hash from any possible response(),
                // don't give client more info than it needs
                delete res[0].pw_hash

                // we have a match! inform the client
                response.json(res[0])
            } else {
                // we don't have a match
                throw new Error("bad credentials")  // WHY DOES THIS THROW CRASH!??!?!!?!?
            }
        })
    })
    // WHY ISNT THIS REACHED WHEN THERE'S A PASSWORD MISMATCH?
    .catch(err => {
        console.error('signin error: ', err)
        response.status(403).json({
            name: err.message,
            severity: 'auth error',
            code: 403
        })
    })
})

Ok so: - When a correct username and correct password is supplied, it functions as expected. - When an incorrect username is supplied, the .catch is reached (ie. functions as expected). - BUT: when a correct username and an incorrect password is supplied, the throw statement (with the comment // WHY DOES THIS THROW CRASH?)... crashes node.

Here's the call stack:

C:\.............\server.js:83
                throw new Error("bad credentials")      // WHY DOES THIS THROW CRASH!??!?!!?!?
                ^

Error: bad credentials
    at C:\.............\server.js:83:23
    at C:\.............\node_modules\bcrypt-nodejs\bCrypt.js:689:3
    at processTicksAndRejections (internal/process/task_queues.js:75:11)
[nodemon] app crashed - waiting for file changes before starting...

I could "cheat" and just do a response.status(403).... instead of that throw. But in my mind, throwing that error ought to jump to the .catch, and handle any auth failure there.

Can anyone help me w/ what's going on here? It's very frustrating.

PS. This crash only seems to be happening when the throw is within the bcrypt.compare callback. I figure that has something to do with it. I've googled.. I've looked around on here.. I've wrapped things in try/catch blocks. I'm just beating my head against it at this point.

Thank you! :)