In general, vulnerabilities can be reported as an issue, pull requests are very welcome. If you'd like to report privately, please email jademichael+http-server@jmthornton.net.