CVE-2026-47219

What it actually does

The flaw is a remotely triggerable denial-of-service condition in applications using the find-my-way HTTP router with Node.js HTTP/2. The router uses the request method as a key into a normal JavaScript object. Under HTTP/2, an attacker can supply unusual method values such as inherited JavaScript object property names. Instead of cleanly rejecting an unknown method, the lookup path may resolve an inherited property and then treat it as a router node, causing a runtime exception when the code accesses router-node fields such as prefix.length. Because the attack is network-reachable, requires no authentication, and can crash the Node.js process or request handler, the primary impact is loss of availability.

Why it matters to the business

Affected services can be taken offline by a small number of crafted HTTP/2 requests, causing outages, failed API calls, customer-facing errors, degraded reliability, and potential cascading failures in dependent services. The CVSS score is high for availability impact, but EPSS is currently low and there is no known CISA KEV listing or ransomware association, so remediation should be prioritized for internet-facing or business-critical Node.js services using find-my-way with HTTP/2 rather than treated as confirmed active mass exploitation.

How an attack unfolds

An attacker identifies a Node.js service that uses find-my-way as its router and accepts HTTP/2 traffic. The attacker sends a crafted HTTP/2 request where the method pseudo-header is set to a JavaScript object-inherited property name, for example constructor, toString, or __proto__. During route lookup, the application passes the method value into find-my-way. The router indexes its method tree object using that value and may receive an inherited object property instead of an expected route tree or undefined. The router then continues as if the returned value were a valid internal node and attempts to read node metadata, triggering an exception. If the application does not safely contain that exception, the Node.js process or worker can crash, producing a denial of service. Repeating the request can keep the service unavailable until upgraded or otherwise mitigated.

How to fix it

Upgrade find-my-way to a fixed version as published by the package maintainer. The supplied advisory text states that versions prior to 9.7.0 are affected but also states the issue is fixed in 9.0.7; because those version statements conflict, confirm the authoritative fixed release in the upstream advisory, npm package metadata, and lockfile resolution, then pin to the corrected non-vulnerable version or later. Rebuild and redeploy applications so transitive dependencies resolve to the fixed package. If immediate upgrade is not possible, reduce exposure by disabling HTTP/2 for affected services where feasible, placing an HTTP/2-aware proxy or WAF in front of the service that rejects nonstandard or dangerous method values, and adding application-level validation that only permits expected HTTP methods before routing. Also ensure Node.js process managers restart crashed workers, but treat restart-only controls as resilience measures, not a fix.

How to confirm the fix worked

Confirm exposure by inspecting package manifests and lockfiles for find-my-way versions in the affected range and by identifying applications that enable Node.js HTTP/2. After remediation, verify that the deployed dependency tree resolves to the fixed find-my-way version, not only that package.json was changed. In staging, send benign validation requests over HTTP/2 using abnormal method values such as constructor, toString, and __proto__; the service should reject them with a controlled 4xx response or equivalent and must not throw uncaught exceptions, reset workers, or exit the Node.js process. Review runtime logs during validation for absence of find-my-way stack traces, uncaughtException events, and process restarts. For containerized deployments, confirm the running image contains the updated lockfile and node_modules content rather than an older cached layer.

Typical attack path

1. Find an HTTP/2-enabled Node.js application that uses find-my-way directly or through a framework dependency.
2. Open an HTTP/2 connection to the exposed service.
3. Send a request with an abnormal :method pseudo-header value that collides with inherited JavaScript object properties, such as constructor, toString, or __proto__.
4. Trigger find-my-way route lookup on the crafted request.
5. Cause the router to treat an inherited object property as an internal route node and throw a runtime exception.
6. Repeat requests as needed to crash workers or keep the service unavailable.

How to detect it

Look for evidence of abnormal HTTP/2 method values immediately before Node.js crashes, 5xx spikes, worker restarts, or container restarts. Useful sources include HTTP/2 ingress proxy logs, API gateway logs, WAF logs, load balancer logs that preserve the :method pseudo-header, application access logs, Node.js stderr/stdout, process-manager logs such as PM2 or systemd, container orchestration events, APM exception traces, and crash dumps. Search for requests where the HTTP/2 :method or logged method field equals constructor, toString, or __proto__. Correlate those events with stack traces referencing find-my-way, TypeError exceptions involving prefix.length, uncaughtException messages, abrupt connection resets, health-check failures, and restart events. Because exploitation causes denial of service rather than persistence, do not expect durable host artifacts; the strongest indicators are crafted request metadata paired with router exceptions or process exits.

• :method: constructor
• :method: toString
• :method: __proto__
• "method":"constructor"
• "method":"toString"
• "method":"__proto__"
• method=constructor
• method=toString
• method=__proto__
• Cannot read properties of undefined (reading 'length')
• Cannot read properties of null (reading 'length')
• prefix.length
• node_modules/find-my-way
• find-my-way/index.js
• uncaughtException
• constructor HTTP/2
• toString HTTP/2
• __proto__ HTTP/2

What your security team should do

• Inventory Node.js services and frameworks that include find-my-way, prioritizing internet-facing and HTTP/2-enabled endpoints.
• Patch or pin find-my-way to the maintainer-confirmed fixed version or later, then redeploy from clean builds so lockfiles and containers are updated.
• Until patched, block or normalize abnormal HTTP/2 :method values at ingress proxies, load balancers, API gateways, or WAFs.
• Add monitoring for HTTP/2 requests with :method values of constructor, toString, or __proto__, especially when followed by 5xx errors, process restarts, or uncaught exceptions.
• Review application logs, process-manager logs, container restart counts, and APM traces for evidence of crashes involving find-my-way route lookup.
• Ensure production Node.js services have safe error handling and process supervision to limit outage duration, while recognizing this does not remove the vulnerability.
• Track the upstream advisory because the provided version information is inconsistent, and verify the exact fixed version before closing remediation work.