CVE-2026-47219: find-my-way: DDoS with HTTP2
Remotely triggerable DoS in find-my-way when it is used with Node’s HTTP/2 server.
The short version is that lookup() passes req.method into find(), and find() indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or __proto__ can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches currentNode.prefix.length.
References
- github.com/advisories/GHSA-c96f-x56v-gq3h
- github.com/delvedor/find-my-way/commit/cfe3fd6168b5ac1594c0820fb83fce251a533fc1
- github.com/delvedor/find-my-way/pull/434
- github.com/delvedor/find-my-way/releases/tag/v9.7.0
- github.com/delvedor/find-my-way/security/advisories/GHSA-c96f-x56v-gq3h
- nvd.nist.gov/vuln/detail/CVE-2026-47219
Code Behaviors & Features
Detect and mitigate CVE-2026-47219 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →