Convert CVE-2026-6636

No vendor-released patch is available, as the maintainer has not responded to early disclosure and continues rolling releases without tagged security fixes. Organizations must implement one or more of the following compensating controls: (1) Restrict API access via network-level controls-limit exposure of the Bun.serve endpoint to trusted internal networks only, using firewall rules or reverse proxy authentication (trade-off: may impact legitimate remote access); (2) Implement input validation at the reverse proxy layer-block requests with pathname parameters containing ../, %2e%2e, or other directory traversal sequences before they reach the Bun.serve handler (trade-off: requires maintenance as bypass techniques evolve); (3) Run p2r3 convert in a restricted filesystem container (Docker/chroot) with minimal permissions, limiting the attacker's ability to read sensitive files outside the application directory (trade-off: container deployment required); (4) Fork the upstream repository and apply a local patch that sanitizes pathname inputs using path.normalize() or path.resolve() with a base directory constraint, then deploy the patched version (trade-off: maintenance burden on your team). Do not rely on file permission restrictions alone-if the application process runs with broad read permissions, traversal can succeed. Consult the GitHub advisory at https://github.com/Dave-gilmore-aus/security-advisories/blob/main/convert-advisory for additional context and any community-provided patches.