find-my-way: DDoS with HTTP2

CAO 7.5CVE-2026-47219 · GHSA-c96f-x56v-gq3h · Công bố 28/07/2026 · cập nhật 23/10/2026

Tóm tắt nhanh

CVE-2026-47219 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng find-my-way.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.46%, cao hơn 40.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 9.7.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
find-my-way npm	`< 9.7.0`	`9.7.0`

Mô tả

Impact

Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server.

The short version is that lookup() passes req.method into find(), and find() indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or __proto__ can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches currentNode.prefix.length.

Patches

Upgrade to v9.7.0.

Workarounds

Do not use find-my-way with HTTP/2 servers, or validate that the http method is valid beforehand.

Mô tả của NVD

find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The lookup() function passes req.method into find(), and find() indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or __proto__ can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches currentNode.prefix.length. This issue has been fixed in version 9.0.7.