serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.Referenceshttps://hackerone.com/reports/308721
