`indexFile` option passed as an argument to node-server can lead to arbitrary file read

I would like to report Path Traversal vulnerability in `indexFile` parameter passed as an option to`node-server`. This vulnerability affects both CLI `--indexFile` and `options.indexFile` passed as an argument to `Server.prototype.serveDir` function in `node-static.js`

// node-static/lib/node-static.js; lines from 52:

Server.prototype.serveDir = function (pathname, req, res, finish) {
    var htmlIndex = path.join(pathname, this.options.indexFile),   //// <-- this.options.indexFile passed "as is"
        that = this;

    fs.stat(htmlIndex, function (e, stat) { …