CVE-2026-47219

Summary

find-my-way: DDoS with HTTP2

Severity

high

CVSS

7.5

EPSS

0.5% (p40)

CWE

CWE-1321

Also known as

GHSA-c96f-x56v-gq3h

Published

2026-07-23

Updated

2026-07-23

Advisory details

Impact

Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server.

The short version is that lookup() passes req.method into find(), and find() indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or __proto__ can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches currentNode.prefix.length.

Patches

Upgrade to v9.7.0.

Workarounds

Do not use find-my-way with HTTP/2 servers, or validate that the http method is valid beforehand.

References

• https://github.com/advisories/GHSA-c96f-x56v-gq3h
• https://github.com/delvedor/find-my-way/security/advisories/GHSA-c96f-x56v-gq3h
• https://github.com/delvedor/find-my-way/pull/434
• https://github.com/delvedor/find-my-way/commit/cfe3fd6168b5ac1594c0820fb83fce251a533fc1
• https://github.com/delvedor/find-my-way/releases/tag/v9.7.0

Related advisories

• CVE-2026-105857 — critical · npm/@payloadcms/plugin-form-builder
• CVE-2026-105844 — critical · npm/@payloadcms/plugin-import-export
• CVE-2026-104848 — critical · npm/tinypool
• CVE-2026-104849 — critical · npm/tinypool
• CVE-2026-92953 — critical · npm/vm2
• CVE-2026-102992 — critical · npm/piscina
• CVE-2026-61534 — critical · npm/yayson
• CVE-2026-53609 — critical · npm/apostrophe

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity