Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when showHidden is false.
Advisories for Npm/Inert package
2020
2014
Hidden Directories always served
The inert directory handler always allows files in hidden directories to be served, even when showHidden is false.