Packages / find-my-way / Security

HighVulnerabilityGHSA-c96f-x56v-gq3hCVE-2026-47219Published 23 Jul 2026

find-my-way: DDoS with HTTP2

Your version

Affected releases · find-my-way

  • 9.x9.0.0 – 9.6.0Fixed in 9.7.0
  • 8.x and older0.0.1 – 8.2.2No fix, no longer updated

On 9.x, the newest line:

npm install find-my-way@9.7.0
Every release on a timeline
9.x

  1. Affected

    9.0.0 – 9.6.0

    8 releases

  2. Fixed

    9.7.0 – 9.10.0

    4 releases, latest

8.x

  1. Affected

    8.0.0 – 8.2.2

    5 releases

7.x

  1. Affected

    7.0.0 – 7.7.0

    13 releases

6.x

  1. Affected

    6.0.0 – 6.4.0

    5 releases

5.x

  1. Affected

    5.0.0 – 5.6.0

    10 releases

4.x

  1. Affected

    4.0.0 – 4.5.1

    10 releases

3.x

  1. Affected

    3.0.0 – 3.0.5

    6 releases

2.x

  1. Affected

    2.0.0 – 2.2.5

    11 releases

1.x

  1. Affected

    1.0.0 – 1.18.1

    42 releases

0.x

  1. Affected

    0.0.1 – 0.2.4

    7 releases

121 stable releases of find-my-way, oldest to newest, one row per major.

What happens

Impact

Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server.

The short version is that lookup() passes req.method into find(), and find() indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or __proto__ can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches currentNode.prefix.length.

Patches

Upgrade to v9.7.0.

Workarounds

Do not use find-my-way with HTTP/2 servers, or validate that the http method is valid beforehand.