Unsafe file path handling can lead to bad things. 

fs.readFile is passed a filename that comes from user params. A user can send a relative file path with the file name to the app for example: 

GET /netcat/..%2Fserver.js