{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/find-my-way--9.6.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["find-my-way (\u003c= 9.6.0)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","nodejs","http2","vulnerability"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA high-severity Denial of Service (DoS) vulnerability, identified as CVE-2026-47219, affects the \u003ccode\u003efind-my-way\u003c/code\u003e Node.js router versions up to 9.6.0 when used in conjunction with HTTP/2 servers. This vulnerability allows remote attackers to trigger a server crash by sending HTTP/2 requests with specially crafted method names. The \u003ccode\u003efind-my-way\u003c/code\u003e router, commonly used in Node.js applications, misinterprets certain HTTP method values (e.g., \u003ccode\u003econstructor\u003c/code\u003e, \u003ccode\u003e__proto__\u003c/code\u003e, \u003ccode\u003etoString\u003c/code\u003e) due to a flaw in its \u003ccode\u003elookup()\u003c/code\u003e and \u003ccode\u003efind()\u003c/code\u003e functions. This leads to an attempt to access properties on unintended JavaScript objects, causing the application to terminate unexpectedly. This vulnerability poses a significant risk to the availability of affected web services, making them susceptible to remote DoS attacks.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker sends a specially crafted HTTP/2 request to a Node.js server running \u003ccode\u003efind-my-way\u003c/code\u003e versions up to 9.6.0.\u003c/li\u003e\n\u003cli\u003eThe request includes a malicious HTTP method name, such as \u003ccode\u003econstructor\u003c/code\u003e or \u003ccode\u003e__proto__\u003c/code\u003e, within the HTTP/2 method field.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003efind-my-way\u003c/code\u003e router receives this request and processes the \u003ccode\u003ereq.method\u003c/code\u003e value using its internal \u003ccode\u003elookup()\u003c/code\u003e and \u003ccode\u003efind()\u003c/code\u003e functions.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003efind()\u003c/code\u003e function attempts to use the malicious method string (e.g., \u003ccode\u003econstructor\u003c/code\u003e) to index \u003ccode\u003ethis.trees[method]\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDue to JavaScript's prototype chain behavior, this lookup resolves to an unexpected inherited object property instead of an intended router node.\u003c/li\u003e\n\u003cli\u003eThe router code then attempts to access properties, such as \u003ccode\u003ecurrentNode.prefix.length\u003c/code\u003e, on this non-router object.\u003c/li\u003e\n\u003cli\u003eThis action results in an unhandled exception and crashes the Node.js application, leading to a Denial of Service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-47219 leads to a complete Denial of Service for the affected Node.js HTTP/2 server. Each malicious request can cause the application to crash, rendering the service unavailable to legitimate users. There is no information regarding the number of specific victims or sectors targeted, but any organization using \u003ccode\u003efind-my-way\u003c/code\u003e with Node.js HTTP/2 is potentially vulnerable. The primary consequence is the disruption of service, which can lead to reputational damage, financial loss, and interruption of critical operations for businesses reliant on these applications.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of the \u003ccode\u003efind-my-way\u003c/code\u003e package to version 9.7.0 or higher to mitigate CVE-2026-47219.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule included in this brief to your SIEM and monitor web server logs for anomalous HTTP method names to detect attempts at exploiting CVE-2026-47219.\u003c/li\u003e\n\u003cli\u003eAs a temporary workaround, validate HTTP methods before processing them with \u003ccode\u003efind-my-way\u003c/code\u003e if immediate upgrade to version 9.7.0 is not feasible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T19:35:25Z","date_published":"2026-07-23T19:35:25Z","id":"https://feed.craftedsignal.io/briefs/2026-07-dos-find-my-way/","summary":"A remotely triggerable Denial of Service (DoS) vulnerability exists in the 'find-my-way' router when used with Node.js HTTP/2 servers. Malicious HTTP/2 method values, such as 'constructor' or '__proto__', can be passed to the 'lookup()' function, which then indexes these values against internal data structures. This leads to a crash when the code attempts to access properties of these unexpected values, such as 'currentNode.prefix.length', causing the server to become unavailable. Users are advised to upgrade to version 9.7.0 or validate HTTP methods before processing.","title":"Denial of Service Vulnerability in find-my-way Node.js Router","url":"https://feed.craftedsignal.io/briefs/2026-07-dos-find-my-way/"}],"language":"en","title":"CraftedSignal Threat Feed - Find-My-Way (\u003c= 9.6.0)","version":"https://jsonfeed.org/version/1.1"}