One way to fix this would be to implement or use an actual dispatcher that would route requests for files to the best matching directory.
I'm not sure if there's a way to prevent the third party NodeJS language client from forwarding requests outside of the targeted directory. That would be worth looking into.