PT-2026-64211 · Npm · Find-My-Way

CVE-2026-47219 · Published 2026-07-23 · Updated 2026-07-23

OSV

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impact

Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server.

The short version is that lookup() passes req.method into find(), and find() indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or proto can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches currentNode.prefix.length.

Patches

Upgrade to v9.7.0.

Workarounds

Do not use find-my-way with HTTP/2 servers, or validate that the http method is valid beforehand.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-47219

GHSA-C96F-X56V-GQ3H

Affected Products

Find-My-Way

References · 6

• https://osv.dev/vulnerability/GHSA-c96f-x56v-gq3h · Vendor Advisory
• https://github.com/delvedor/find-my-way/releases/tag/v9.7.0 · Note
• https://github.com/delvedor/find-my-way/pull/434 · Note
• https://github.com/delvedor/find-my-way · Note
• https://github.com/delvedor/find-my-way/commit/cfe3fd6168b5ac1594c0820fb83fce251a533fc1 · Note
• https://github.com/delvedor/find-my-way/security/advisories/GHSA-c96f-x56v-gq3h · Note