CVE-2026-47219: find-my-way is Vulnerable to DDoS with HTTP2
Impact Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server.
The short version is that lookup() passes req.method into find(), and find() indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or proto can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches currentNode.prefix.length.
Patches
Upgrade to v9.7.0.
Workarounds
Do not use find-my-way with HTTP/2 servers, or validate that the http method is valid beforehand.
Other sources
find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The lookup() function passes req.method into find(), and find() indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or proto can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches currentNode.prefix.length. This issue has been fixed in version 9.0.7.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/find-my-wayto a version that resolves this vulnerability.Fixed in 9.7.0 - Upgrade
Upgrade
find-my-wayto a version that resolves this vulnerability.Fixed in 9.0.7 - Upgrade
Upgrade
find-my-wayto a version that resolves this vulnerability.Fixed in 9.7.0 - Compensating control
Do not use find-my-way with HTTP/2 servers, or validate that the HTTP method is valid beforehand.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47219?
The severity of CVE-2026-47219 is rated high with a score of 7.5.
What type of vulnerability is CVE-2026-47219?
CVE-2026-47219 is a remotely triggerable Denial of Service (DoS) vulnerability.
How can CVE-2026-47219 impact my application?
CVE-2026-47219 can cause a Denial of Service in applications using Node's HTTP/2 server with the find-my-way package.
How do I fix CVE-2026-47219?
To fix CVE-2026-47219, update to the latest version of the find-my-way package that addresses this vulnerability.
Which software is affected by CVE-2026-47219?
CVE-2026-47219 affects the npm/find-my-way package.