Signal is active with 2 mentions in latest observed window
Immediate actions
Patch affected systems immediately
Recommended action window: Monitor and triage in normal cycle
NVD description
find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The lookup() function passes req.method into find(), and find() indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or __proto__ can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches currentNode.prefix.length. This issue has been fixed in version 9.0.7.
🚨*CVE*
CVE-2026-47219 find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerab… https://www.cve.org/CVERecord?id=CVE-2026-47219
-----
Traducción:
CVE-2026-47219 fin… http://infoflow.cloud`
Post summary
The text announces CVE‑2026‑47219, highlighting that find‑my‑way router versions before 9.7.0 are vulnerable, but offers no further exploit or mitigation details.
CVE-2026-47219 find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerab… https://www.cve.org/CVERecord?id=CVE-2026-47219
Post summary
The post announces CVE‑2026‑47219 affecting find‑my‑way routers prior to version 9.7.0, with no PoC, exploit, patch, or active exploitation details.
🚨 HIGH - HTTP/2 method property injection crash in find-my-way (CVE-2026-47219)
A remotely triggerable denial of service exists in the find-my-way router when it’s used behind Node.js HTTP/2 servers, where the HTTP/2 :method value is used during route lookup. The root cause is unsafe property access / prototype pollution-style behavior: special method names like constructor, toString, or __proto__ can resolve inherited object properties and get misinterpreted as router nodes. An attacker can exploit this over the network by sending crafted HTTP/2 requests with these method values, requiring no authentication or local privileges, as long as the target accepts HTTP/2 traffic through the affected routing path. Successful exploitation crashes the process, taking the service offline and enabling repeatable denial of service.
👉 Affected: find-my-way < 9.7.0 (when used with Node.js HTTP/2 servers) | Upgrade to 9.7.0
Post summary
CVE-2026-47219 is a remotely triggerable denial‑of‑service flaw in find‑my‑way caused by unsafe HTTP/2 method handling; upgrading to v9.7.0 resolves the issue.
