Executive brief
A denial-of-service vulnerability exists in the find-my-way HTTP router, a component used by web applications to direct incoming traffic. By sending a specially crafted request using the HTTP/2 protocol, an attacker can cause the application to crash. This results in a complete service outage, preventing legitimate users from accessing the application until it is restarted.
Technical details
A Denial of Service (DoS) vulnerability exists in find-my-way versions prior to 9.7.0 when integrated with Node.js HTTP/2 servers. The vulnerability is caused by improper input validation in the lookup() function, which passes the request method directly to the find() function. Because the internal routing table (this.trees) is a standard JavaScript object, an attacker can provide reserved property names such as 'constructor', 'toString', or '__proto__' as the HTTP method. The router attempts to process these inherited object properties as if they were valid router nodes, leading to an uncaught exception and application crash when accessing 'currentNode.prefix.length'. This is fixed in version 9.7.0.
Affected products
- delvedor find-my-way < 9.7.0
Timeline
- 2026-07-22: advisory: GitHub Security Advisory published
- 2026-07-28: disclosed: NVD publication date