PT-2026-64211 · Npm · Find-My-Way

CVE-2026-47219 · Publicado 2026-07-23 · Atualizado 2026-07-23

OSV

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impact

Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server.

The short version is that lookup() passes req.method into find(), and find() indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or proto can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches currentNode.prefix.length.

Patches

Upgrade to v9.7.0.

Workarounds

Do not use find-my-way with HTTP/2 servers, or validate that the http method is valid beforehand.

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

CVE-2026-47219

GHSA-C96F-X56V-GQ3H

Produtos afetados

Find-My-Way

Referências · 6

• https://github.com/delvedor/find-my-way/releases/tag/v9.7.0 · Nota
• https://github.com/delvedor/find-my-way/pull/434 · Nota
• https://github.com/delvedor/find-my-way · Nota
• https://github.com/delvedor/find-my-way/commit/cfe3fd6168b5ac1594c0820fb83fce251a533fc1 · Nota
• https://github.com/delvedor/find-my-way/security/advisories/GHSA-c96f-x56v-gq3h · Nota
• https://osv.dev/vulnerability/GHSA-c96f-x56v-gq3h · Aviso do Fabricante