Package map subpath resolves outside the target package directory

Version

v26.5.0

Platform

Subsystem

module

What steps will reproduce the bug?

  // package-map.json
  {
    "packages": {
      "app": { "url": "./app", "dependencies": { "dep": "dep" } },
      "dep": { "url": "./dep", "dependencies": {} }
    }
  }

  // app/index.js
  require('dep/../../secret.js');

node --experimental-package-map ./package-map.json app/index.js

How often does it reproduce? Is there a required condition?

always

What is the expected behavior? Why is that the expected behavior?

Resolution should fail with ERR_INVALID_MODULE_SPECIFIER, because the subpath escapes the target package's own directory (dep) as declared in the package map.

What do you see instead?

The specifier resolves successfully to a file outside the target package directory.

Additional information

No response

Inizia eseguendo la riproduzione di package-map.json con app/index.js e node --experimental-package-map. Traccia come viene risolto il sottopercorso dep quando contiene ../../secret.js e verifica che la risoluzione rifiuti qualsiasi percorso al di fuori di dep con ERR_INVALID_MODULE_SPECIFIER.