CVE-2026-47219 Overview
CVE-2026-47219 is a denial of service vulnerability in find-my-way, a framework-independent HTTP router used by Node.js applications. The flaw affects deployments that pair find-my-way with Node's HTTP/2 server. Attackers can crash the server remotely by sending requests with method names that collide with inherited Object properties such as constructor, toString, or __proto__. The router's internal trees object returns these inherited properties instead of undefined, causing the routing logic to dereference invalid data and terminate the process. The issue is tracked under [CWE-20] Improper Input Validation and is fixed in the release referenced by the maintainer's GitHub Security Advisory.
Critical Impact
Unauthenticated remote attackers can crash Node.js HTTP/2 servers backed by find-my-way with a single malformed request, producing a full availability loss.
Affected Products
- find-my-way versions prior to the fixed release identified in GHSA-c96f-x56v-gq3h
- Node.js applications that mount find-my-way behind an HTTP/2 server
- Frameworks and services that embed find-my-way as their routing layer
Discovery Timeline
- 2026-07-28 - CVE-2026-47219 published to NVD
- 2026-07-29 - Last updated in NVD database
Technical Details for CVE-2026-47219
Vulnerability Analysis
The defect lives in the router's method-to-tree lookup path. The lookup() function forwards req.method directly into find(), which then reads this.trees[method] to select a Radix tree for the HTTP verb. Because this.trees is a plain JavaScript object, any property access falls through the prototype chain when the own property is absent.
HTTP/2 does not restrict pseudo-header method values to a fixed set the way find-my-way's internal table assumes. An attacker can supply method strings that match names on Object.prototype, such as constructor or toString. The lookup then returns a function reference or another inherited value rather than undefined.
The routing code treats that returned value as a tree node and reads currentNode.prefix.length. The inherited property has no prefix field, so the dereference throws and the Node.js process terminates. Because the request is processed before any application middleware, defensive checks at the framework layer do not intervene.
Root Cause
The root cause is missing input validation on the HTTP method string combined with the use of a prototype-inheriting object as a lookup table. The router assumes this.trees[method] returns either a valid tree node or undefined, but that invariant breaks when the key collides with an inherited property.
Attack Vector
Exploitation requires only network reach to an HTTP/2 endpoint served by a vulnerable version of find-my-way. The attacker crafts an HTTP/2 request whose :method pseudo-header is set to a value such as constructor. No authentication, session, or user interaction is required. Each crafted request crashes the worker process, and repeated requests sustain the denial of service.
See the GitHub Security Advisory for the maintainer's technical write-up.
Detection Methods for CVE-2026-47219
Indicators of Compromise
- HTTP/2 request logs showing :method values equal to constructor, toString, hasOwnProperty, __proto__, or other Object.prototype member names.
- Repeated unexpected Node.js process restarts correlated with inbound HTTP/2 traffic.
- Uncaught TypeError stack traces referencing currentNode.prefix.length inside find-my-way.
Detection Strategies
- Parse reverse-proxy and application access logs for non-standard HTTP method tokens and alert on any value outside the RFC 7231 and RFC 7540 method set.
- Correlate Node.js crash events with the preceding request stream to identify method-based triggers.
- Add synthetic probes that send benign non-standard methods to non-production replicas to validate patch status.
Monitoring Recommendations
- Track process restart counts and unhandled exception rates for services that expose HTTP/2 endpoints.
- Ingest web-tier and application logs into a centralized analytics pipeline and alert on spikes in 5xx responses or connection resets tied to specific client IPs.
- Enable HTTP/2 frame-level logging on ingress proxies to preserve the offending :method value for forensic review.
How to Mitigate CVE-2026-47219
Immediate Actions Required
- Inventory all Node.js services and identify direct and transitive dependencies on find-my-way.
- Upgrade find-my-way to the fixed version identified in GHSA-c96f-x56v-gq3h.
- Restart affected services after upgrade and verify the patched version is loaded at runtime.
- If patching cannot be completed immediately, terminate HTTP/2 at a reverse proxy that enforces the standard method allowlist.
Patch Information
The maintainer has released a fixed build referenced in GHSA-c96f-x56v-gq3h. Consult the advisory for the exact fixed version string and apply the upgrade using your package manager. Confirm the resolved version in package-lock.json or yarn.lock after installation.
Workarounds
- Front the Node.js service with a reverse proxy such as NGINX or Envoy configured to reject any HTTP method outside a strict allowlist of GET, POST, PUT, PATCH, DELETE, HEAD, and OPTIONS.
- Disable HTTP/2 on the Node.js listener until the patched dependency is deployed, forcing clients to use HTTP/1.1 where the method parser is more restrictive.
- Add a pre-router middleware that validates req.method against an explicit allowlist and returns 400 Bad Request for any other value.
# Configuration example: upgrade find-my-way and verify the resolved version
npm install find-my-way@latest
npm ls find-my-way
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
