high · 7.5CVE-2026-47219Jul 23, 2026

CVE-2026-47219: find-my-way Prototype Property Lookup DoS via HTTP/2 Method

Rohit Hatagale
AI Security Researcher, SecureLayer7

Sending an HTTP/2 request with a method name like 'constructor' or 'toString' crashes any Node.js server using find-my-way as its router, because the router looks up the method name on a plain object…

Packagefind-my-way
Ecosystemnpm
Affected<= 9.6.0
Fixed in9.7.0
CVE-2026-47219: find-my-way Prototype Property Lookup DoS via HTTP/2 Method

The problem

find-my-way stores route trees in a plain object keyed by HTTP method (GET, POST, etc.). The lookup() function passes req.method directly into find(), which reads this.trees[method] without checking whether that key is an own property.

HTTP/2 allows any string as the :method pseudo-header value. Sending constructor, toString, or __proto__ causes this.trees[method] to resolve an inherited property from Object.prototype (for example, the Function object for constructor). The router then tries to read .prefix.length on that value, which throws a TypeError and crashes the Node.js process.

Any unauthenticated remote client can trigger this repeatedly for a sustained DoS.

Proof of concept

A working proof-of-concept for CVE-2026-47219 in find-my-way, with the exact payload below.

javascript
// Send a single HTTP/2 request with :method set to 'constructor'
// Using h2load, nghttp, or any HTTP/2 client:

// Node.js PoC client (requires node:http2)
const http2 = require('node:http2');
const client = http2.connect('http://localhost:3000');
const req = client.request({
  ':method': 'constructor',  // resolves Object.prototype.constructor on this.trees
  ':path': '/any/route',
});
req.end();

// Also works with: 'toString', '__proto__', 'hasOwnProperty', 'valueOf'

The root cause is an unguarded property access on a plain object: this.trees[method] will walk the prototype chain when method is not an own property. For constructor, this.trees['constructor'] returns Object (the constructor function). The router then executes currentNode.prefix.length on that function object, where .prefix is undefined, causing TypeError: Cannot read properties of undefined (reading 'length') and crashing the server.

HTTP/2 is the prerequisite because the Node.js HTTP/1.1 parser enforces a strict allowlist of method tokens before the application ever sees req.method. HTTP/2 does not enforce this at the protocol layer, so the raw pseudo-header value reaches the application unchanged.

The patch (PR #434, commit cfe3fd6) adds an explicit method validation step before this.trees[method] is accessed, ensuring only known, registered methods are looked up. This is CWE-1321: Improperly Controlled Modification of Object Prototype Attributes.

The fix

Upgrade find-my-way to v9.7.0 or later. If an immediate upgrade is not possible, validate that req.method is a member of a known allowlist (GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS, TRACE, CONNECT) before passing the request to find-my-way, or disable HTTP/2 support until you can patch.

Reporter not attributed.

References: [1][2][3][4][5]

Related research