---
title: "GHSA-c96f-x56v-gq3h: find-my-way: DDoS with HTTP2"
description: "High severity. find-my-way: DDoS with HTTP2. Affects find-my-way; fixed in 9.7.0."
url: https://inlinr.com/advisories/GHSA-c96f-x56v-gq3h
lang: en
---

[Packages](https://inlinr.com/packages) / [find-my-way](https://inlinr.com/packages/find-my-way) / [Security](https://inlinr.com/packages/find-my-way/security)

High Vulnerability GHSA-c96f-x56v-gq3h CVE-2026-47219 Published 23 Jul 2026

# find-my-way: DDoS with HTTP2

Your version 

Affected releases · [find-my-way](https://inlinr.com/packages/find-my-way)

- 9.x 9.0.0 – 9.6.0 Fixed in 9.7.0
- 8.x and older 0.0.1 – 8.2.2 No fix, no longer updated

On 9.x, the newest line:

```
npm install find-my-way@9.7.0
```

Every release on a timeline

9.x 

1. Affected

9.0.0 – 9.6.0  
8 releases
2. Fixed

9.7.0 – 9.10.0  
4 releases, latest

8.x 

1. Affected

8.0.0 – 8.2.2  
5 releases

7.x 

1. Affected

7.0.0 – 7.7.0  
13 releases

6.x 

1. Affected

6.0.0 – 6.4.0  
5 releases

5.x 

1. Affected

5.0.0 – 5.6.0  
10 releases

4.x 

1. Affected

4.0.0 – 4.5.1  
10 releases

3.x 

1. Affected

3.0.0 – 3.0.5  
6 releases

2.x 

1. Affected

2.0.0 – 2.2.5  
11 releases

1.x 

1. Affected

1.0.0 – 1.18.1  
42 releases

0.x 

1. Affected

0.0.1 – 0.2.4  
7 releases

121 stable releases of find-my-way, oldest to newest, one row per major.

## What happens

Impact

Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server.

The short version is that `lookup()` passes `req.method` into `find()`, and `find()` indexes `this.trees[method]`. Since `this.trees` is a normal object, HTTP/2 method values like constructor, `toString`, or `__proto__` can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches `currentNode.prefix.length`.

Patches

Upgrade to v9.7.0.

Workarounds

Do not use find-my-way with HTTP/2 servers, or validate that the http method is valid beforehand.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [Reference](https://github.com/delvedor/find-my-way/security/advisories/GHSA-c96f-x56v-gq3h "https://github.com/delvedor/find-my-way/security/advisories/GHSA-c96f-x56v-gq3h")  
github.com/delvedor/find-my-way/security/adviso…
- [Pull request](https://github.com/delvedor/find-my-way/pull/434 "https://github.com/delvedor/find-my-way/pull/434")  
#434
- [Fix commit](https://github.com/delvedor/find-my-way/commit/cfe3fd6168b5ac1594c0820fb83fce251a533fc1 "https://github.com/delvedor/find-my-way/commit/cfe3fd6168b5ac1594c0820fb83fce251a533fc1")  
cfe3fd6
- [Package](https://github.com/delvedor/find-my-way "https://github.com/delvedor/find-my-way")  
github.com/delvedor/find-my-way
- [Reference](https://github.com/delvedor/find-my-way/releases/tag/v9.7.0 "https://github.com/delvedor/find-my-way/releases/tag/v9.7.0")  
github.com/delvedor/find-my-way/releases/tag/v9…