visionmedia/send — pull request #60 by iliakan (2014-09-04 17:55:19+00:00)
Title: Insecure comparison

Without that fix, a path `/my-secret` is consedered fine for the root `/my`.

Maybe the issue is autofixed by the next `parts` assignment? Not sure exactly if the vulnerability exists, but the comparison is insecure.