One missing slash in an alias
A location without a trailing slash plus an alias with one lets /assets../ step out of the static folder. Read the config and the log to see what was read through the gap.
Briefing
nginx’s alias replaces the matched location prefix with a path. With location /assets and alias /srv/site/static/, a request for /assets../x becomes /srv/site/static/../x, one directory up, with no ../ ever reaching nginx’s normalizer.
The access log shows a visitor testing the classic ../ first, which nginx rejected, then the off-by-slash form.
web-02 · Web config review
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.