CVE-2026-47219

Received Received - Intake

DoS in find-my-way with Node.js HTTP/2 Server

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The lookup() function passes req.method into find(), and find() indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or __proto__ can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches currentNode.prefix.length. This issue has been fixed in version 9.0.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-47219

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

The vulnerability is a remotely triggerable denial-of-service (DoS) in the find-my-way HTTP router library when used with Node's HTTP/2 server. It occurs because the lookup function passes the HTTP/2 method values like constructor or toString into the find function, which incorrectly treats these as router nodes and crashes when accessing properties.

Detection Guidance

This vulnerability can be detected by checking the version of the find-my-way library in use. If your application uses Node's HTTP/2 server with find-my-way versions prior to 9.7.0, it is vulnerable. Commands to check include: npm list find-my-way for Node.js projects or inspecting package.json dependencies.

Impact Analysis

This vulnerability can cause your application to crash or become unresponsive if an attacker sends specially crafted HTTP/2 requests. This leads to a denial-of-service condition, disrupting service availability for legitimate users.

Compliance Impact

This vulnerability is a remotely triggerable denial-of-service (DoS) issue that could lead to service unavailability. For GDPR, this may impact availability of personal data processing systems, potentially violating Article 32 requirements for resilience. For HIPAA, it could disrupt healthcare services handling protected health information, affecting the Security Rule's integrity and availability requirements.

Mitigation Strategies

Upgrade find-my-way to version 9.0.7 or later to address the DoS vulnerability in HTTP/2 server usage.

Hi! I’m here to help you understand CVE-2026-47219. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70