CVE-2026-47219: delvedor find-my-way denial of service in HTTP/2 routing

CVE-2026-47219 · Severity: high · CVSS 7.5 · Published 2026-07-28

A denial-of-service vulnerability exists in the find-my-way HTTP router, a component used by web applications to direct incoming traffic. By sending a specially crafted request using the HTTP/2 protocol, an attacker can cause the application to crash. This results in a complete service outage, preventing legitimate users from accessing the application until it is restarted.

Technologies: find-my-way (npm). Vendors: npm.

Quick answers

Is CVE-2026-47219 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47219 being exploited in the wild.
How severe is CVE-2026-47219?
High severity, with a CVSS score of 7.5, published 28 July 2026.
Which products and versions are affected?
find-my-way (npm) <= 9.6.0, SEMVER:introduced=0,fixed=9.7.0.
Is there a fix for CVE-2026-47219?
Yes. find-my-way (npm): upgrade to 9.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47219 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-47219?
Check whether you run find-my-way (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • find-my-way (npm): upgrade to 9.7.0 or later
    npm install find-my-way@9.7.0

Technical details

A Denial of Service (DoS) vulnerability exists in find-my-way versions prior to 9.7.0 when integrated with Node.js HTTP/2 servers. The vulnerability is caused by improper input validation in the lookup() function, which passes the request method directly to the find() function. Because the internal routing table (this.trees) is a standard JavaScript object, an attacker can provide reserved property names such as 'constructor', 'toString', or '__proto__' as the HTTP method. The router attempts to process these inherited object properties as if they were valid router nodes, leading to an uncaught exception and application crash when accessing 'currentNode.prefix.length'. This is fixed in version 9.7.0.

Affected products

  • delvedor find-my-way < 9.7.0

Identifiers

  • CVE-2026-47219
  • GHSA-c96f-x56v-gq3h

Timeline

  • 2026-07-22: advisory: GitHub Security Advisory published
  • 2026-07-28: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.