AIKIDO-2026-940031

TL;DR

The static file middleware (serveStatic) serves files from a directory but only checks containment lexically and does not resolve symbolic links, so a symlink inside the served root can expose arbitrary files elsewhere on the host. It also fails to deny dotfiles that carry an extension, allowing sensitive files such as environment files and version-control metadata to be fetched directly. On-the-fly Brotli compression runs at maximum quality without size bounds, enabling CPU amplification. The fix re-asserts containment against the realpath, denies dot segments by default except .well-known, and bounds compression.