{"id":"GHSA-c96f-x56v-gq3h","revision":"eed8504af1914f16857e68de48f63642","records":[{"revision":"eed8504af1914f16857e68de48f63642","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-c96f-x56v-gq3h","aliases":["CVE-2026-47219"],"title":"find-my-way: DDoS with HTTP2","description":"### Impact\nRemotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server.\n\nThe short version is that `lookup()` passes `req.method` into `find()`, and `find()` indexes `this.trees[method]`. Since `this.trees` is a normal object, HTTP/2 method values like constructor, `toString`, or `__proto__` can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches `currentNode.prefix.length`.\n\n### Patches\n\nUpgrade to v9.7.0.\n\n### Workarounds\n\nDo not use find-my-way with HTTP/2 servers, or validate that the http method is valid beforehand.","state":0,"publishedAt":"2026-07-23T19:33:15+00:00","modifiedAt":"2026-07-23T19:56:40.779403+00:00","affected":[{"ecosystem":"npm","name":"find-my-way","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"9.7.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/delvedor/find-my-way/security/advisories/GHSA-c96f-x56v-gq3h","https://github.com/delvedor/find-my-way/pull/434","https://github.com/delvedor/find-my-way/commit/cfe3fd6168b5ac1594c0820fb83fce251a533fc1","https://github.com/delvedor/find-my-way","https://github.com/delvedor/find-my-way/releases/tag/v9.7.0"],"sourceUrl":"https://github.com/advisories/GHSA-c96f-x56v-gq3h","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-c96f-x56v-gq3h","identifiers":["GHSA-c96f-x56v-gq3h","CVE-2026-47219"]},"retained":false,"historicalAffected":[]}],"coverage":[]}