Directory traversal vulnerability
An attacker can provide input such as ../ to read files outside of the served directory.
Advisories for Npm/Nhouston package
2014
An attacker can provide input such as ../ to read files outside of the served directory.