{"id":"GHSA-c96f-x56v-gq3h","summary":"find-my-way: DDoS with HTTP2","details":"### Impact\nRemotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server.\n\nThe short version is that `lookup()` passes `req.method` into `find()`, and `find()` indexes `this.trees[method]`. Since `this.trees` is a normal object, HTTP/2 method values like constructor, `toString`, or `__proto__` can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches `currentNode.prefix.length`.\n\n### Patches\n\nUpgrade to v9.7.0.\n\n### Workarounds\n\nDo not use find-my-way with HTTP/2 servers, or validate that the http method is valid beforehand.","aliases":["CVE-2026-47219"],"modified":"2026-07-23T19:56:40.553820Z","published":"2026-07-23T19:33:15Z","database_specific":{"cwe_ids":["CWE-1321"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-07-23T19:33:15Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/delvedor/find-my-way/security/advisories/GHSA-c96f-x56v-gq3h"},{"type":"WEB","url":"https://github.com/delvedor/find-my-way/pull/434"},{"type":"WEB","url":"https://github.com/delvedor/find-my-way/commit/cfe3fd6168b5ac1594c0820fb83fce251a533fc1"},{"type":"PACKAGE","url":"https://github.com/delvedor/find-my-way"},{"type":"WEB","url":"https://github.com/delvedor/find-my-way/releases/tag/v9.7.0"}],"affected":[{"package":{"name":"find-my-way","ecosystem":"npm","purl":"pkg:npm/find-my-way"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.7.0"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 9.6.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-c96f-x56v-gq3h/GHSA-c96f-x56v-gq3h.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}