CVE-2026-47219: 
JavaScript vulnerability analysis and mitigation

CVE-2026-47219 is a remotely triggerable Denial of Service (DoS) vulnerability in the find-my-way npm router package when used with Node.js HTTP/2 servers. The vulnerability affects all versions up to and including 9.6.0 and was patched in v9.7.0, published on July 22, 2026. It carries a CVSS v3.1 base score of 7.5 (High), exploitable by unauthenticated remote attackers with no user interaction required (GitHub Advisory, find-my-way Advisory).

The root cause is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes / Prototype Pollution). The lookup() function passes req.method directly into find(), which uses it to index this.trees[method]. Because this.trees was initialized as a plain object ({}), HTTP/2 allows arbitrary method strings — including JavaScript prototype property names such as constructor, toString, or __proto__ — which resolve to inherited object properties rather than returning undefined. The router then attempts to treat the resolved value as a router node and crashes when accessing currentNode.prefix.length on a non-node object. The fix, applied in commit cfe3fd6, changes this.trees = {} to this.trees = Object.create(null), creating a prototype-less object that prevents inherited property resolution (GitHub Advisory, Patch Commit).

Successful exploitation causes the Node.js application using find-my-way to crash, resulting in complete loss of availability for the affected service. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Any application built on frameworks that use find-my-way as their router (such as Fastify) and exposed over HTTP/2 is potentially affected, and repeated requests can sustain a denial-of-service condition (GitHub Advisory, find-my-way Advisory).

1. Reconnaissance: Identify internet-facing Node.js services using find-my-way versions ≤ 9.6.0 with HTTP/2 enabled (e.g., Fastify applications). HTTP/2 support can often be inferred from server response headers such as x-powered-by: fastify combined with HTTP/2 protocol negotiation via ALPN.
2. Craft malicious HTTP/2 request: Using an HTTP/2-capable client (e.g., curl --http2, h2c, or a custom script), send a request with a method value set to a JavaScript prototype property name such as constructor, toString, or __proto__.
3. Trigger the crash: The malicious method value is passed through lookup() → find() → this.trees[method], where it resolves an inherited object property. The router attempts to access .prefix.length on the non-node value, throwing an uncaught TypeError that crashes the Node.js process or request handler.
4. Sustain DoS: Repeatedly send such requests to keep the service unavailable, as each request independently triggers the crash condition (GitHub Advisory, Patch Commit).

• Network: Inbound HTTP/2 requests with non-standard or invalid HTTP method values (e.g., constructor, toString, __proto__, hasOwnProperty) in the :method pseudo-header field.
• Logs: Node.js application logs or crash reports showing TypeError: Cannot read properties of undefined (reading 'length') or similar errors originating from find-my-way's routing logic; unexpected process restarts or crash loop entries in process manager logs (e.g., PM2, systemd).
• Process: Sudden termination and restart of the Node.js server process; elevated error rates or 502/503 responses from upstream load balancers coinciding with HTTP/2 traffic spikes.

Upgrade find-my-way to version 9.7.0 or later, which fixes the issue by initializing this.trees with Object.create(null) to prevent prototype property resolution (find-my-way Release). If an immediate upgrade is not possible, two workarounds are available: (1) avoid using find-my-way with Node.js HTTP/2 servers entirely, or (2) add input validation middleware that rejects requests with HTTP method values not in the standard allowed set before they reach the router (GitHub Advisory).

The vulnerability was discovered by security researcher Nadav0077 and remediated by find-my-way maintainer Matteo Collina (mcollina), who also maintains Fastify. The fix was straightforward — a one-line change replacing {} with Object.create(null) — and was included as part of the broader v9.7.0 release (find-my-way Release, find-my-way Advisory). No significant broader media coverage or social media discussion has been observed beyond the advisory publication.