What is the CVSS score of CVE-2026-47219?

CVE-2026-47219 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of find-my-way are affected by CVE-2026-47219?

find-my-way, the HTTP router component underlying Fastify, contains a remote denial-of-service vulnerability in versions up to 9.6.0 when deployed on Node.js HTTP/2 servers.. A patch is available.

How to fix or mitigate CVE-2026-47219?

Within 24 hours, inventory all Fastify deployments running find-my-way 9.6.0 or earlier in HTTP/2 environments and assess their network exposure. Within 7 days, deploy find-my-way version 9.7.0 or upgrade Fastify to incorporate the patched router across all affected systems, prioritizing internet-facing applications. Within 30 days, conduct end-to-end testing on patched deployments and document the patching campaign for compliance and audit purposes.

find-my-way CVE-2026-47219

EUVD-2026-50084 HIGH

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-07-23 https://github.com/delvedor/find-my-way

GHSA-c96f-x56v-gq3h

Denial Of Service Red Hat Prototype Pollution

7.5

CVSS 3.1 · Vendor: https://github.com/delvedor/find-my-way

Severity by source

Vendor (https://github.com/delvedor/find-my-way) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated, no interaction, trivial single-request trigger; pure availability crash with no confidentiality or integrity impact, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (https://github.com/delvedor/find-my-way).

CVSS VectorVendor: https://github.com/delvedor/find-my-way

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 20:01 vuln.today

Analysis Generated

Jul 23, 2026 - 20:01 vuln.today

CVE Published

Jul 23, 2026 - 19:33 github-advisory

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

226 npm packages depend on find-my-way (6 direct, 220 indirect)

Ecosystem-wide dependent count for version 9.7.0.

DescriptionCVE.org

Impact

Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server.

The short version is that lookup() passes req.method into find(), and find() indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or __proto__ can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches currentNode.prefix.length.

Patches

Upgrade to v9.7.0.

Workarounds

Do not use find-my-way with HTTP/2 servers, or validate that the http method is valid beforehand.

AnalysisAI

Remote denial of service in find-my-way (the HTTP router underneath Fastify) affects all versions up to and including 9.6.0 when the router serves requests from a Node.js HTTP/2 server. Because the internal method-to-tree map is a plain JavaScript object, an unauthenticated attacker can send a request whose HTTP method is an inherited Object property name such as constructor, toString, or __proto__, causing find() to treat a prototype value as a router node and crash the process on currentNode.prefix.length. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the trigger is trivial and a fixed release (9.7.0) is available.

Technical ContextAI

find-my-way is a high-performance radix-tree HTTP router for Node.js and is the default router underneath the Fastify web framework. Internally it stores per-method route trees in this.trees, indexed as this.trees[method]. The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes / prototype pollution semantics): because this.trees is an ordinary object rather than a null-prototype map, indexing it with an attacker-controlled key that is an inherited Object.prototype member (constructor, toString, hasOwnProperty, __proto__, etc.) returns the inherited function/value instead of undefined. Under HTTP/1.x, Node's parser rejects such method tokens, but Node's HTTP/2 server surfaces the :method pseudo-header more permissively, so lookup() forwards req.method straight into find(), where the returned prototype value is dereferenced as if it were a tree node and throws when .prefix is read.

RemediationAI

Vendor-released patch: 9.7.0 - upgrade the find-my-way dependency (directly, or transitively via Fastify) to 9.7.0 or later, per advisory GHSA-c96f-x56v-gq3h (https://github.com/delvedor/find-my-way/security/advisories/GHSA-c96f-x56v-gq3h). If you cannot upgrade immediately, the vendor-documented workarounds are to stop serving find-my-way from a Node.js HTTP/2 server (fall back to HTTP/1.x, which rejects the malformed method tokens at the parser level, at the cost of losing HTTP/2 features), or to validate the HTTP method against an allowlist of known-valid verbs before it reaches lookup()/find() and reject anything else with a 400/501 (trade-off: requires an upstream middleware or proxy hook and must cover any custom methods your app legitimately uses). Fixed release and patch are at https://github.com/delvedor/find-my-way/pull/434 and https://github.com/delvedor/find-my-way/releases/tag/v9.7.0.