Limited path traversal in Node.js SDK leads to PII disclosure