CVE-2026-47219

Name of the Vulnerable Software and Affected Versions find-my-way versions prior to 9.7.0

Description A remotely triggerable Denial of Service (DoS) exists when the software is used with Node's HTTP/2 server. The lookup() function passes the req.method variable into the find() function, which then indexes this.trees[method]. Because this.trees is a standard object, specific HTTP/2 method values such as constructor, toString, or proto can resolve inherited object properties instead of returning undefined. The system subsequently treats these properties as router nodes, leading to a crash when accessing currentNode.prefix.length.

Recommendations Update to version 9.7.0. Validate that the HTTP method is valid before processing. Avoid using the software with HTTP/2 servers.