Can web browsers navigate up a directory with the URL's location?

I'm running a few node.js servers on the same framework right now. Somewhere along the lines of code of the framework I have this little snippet:

//...
if (subdomain.staticFolder) {
    let relativePath = subdomain.staticFolder + path.sep + path.normalize(url);
    if (fs.existsSync(relativePath)) {
        let fileStats = fs.statSync(relativePath);
        if (fileStats.isFile()) {
//...

This snippet is located inside the handler that manages request traffic. In a nutshell, what it's doing is looking inside a static/ folder for the domain and seeing if any file matches the request.

My concern is that a malicious user may come along and attempt to gain access to the web server's files, exploiting this lookup method of static files. For example:

https://www.example.com/../index.js

https://www.example.com/../serverStructure.json

Is this possible, or am I just worrisome? And, if it is possible, what are some potential solutions? Would moving static files to an S3 bucket be viable? Even if it isn't possible, is this still bad backend practice anyway?