Remote Triggerable Denial of Service in find-my-way by Delvedor

CVE-2026-47219

What is CVE-2026-47219?

The find-my-way HTTP router is susceptible to a remote denial of service condition when utilized with Node.js's HTTP/2 server. When the lookup() function processes req.method, it calls find(), which indexes into this.trees using HTTP/2 method values like constructor, toString, or proto. These values can inadvertently resolve inherited properties rather than returning 'undefined', leading to scenarios where the code assumes an invalid router node. This mismanagement can cause the application to crash upon reaching currentNode.prefix.length. The issue was addressed in version 9.0.7, ensuring improved stability and security for applications relying on this routing framework.

References