visionmedia/send — pull request #59 by iliakan (2014-09-04 17:48:30+00:00)
Title: Insecure comparison

Without that fix, a path `/my-secret` is consedered fine for the root `/my`.

Maybe the issue is autofixed by the next `parts` assignment? Not sure exactly if the vulnerability exists, but the comparison is insecure.