CVE-2026-47219High· 7.5▾ TwilightA flaw was found in find-my-way, a routing module for Node.js. A remote attacker could exploit this vulnerability when find-my-way is used with Node's HTTP/2 server. By sending specially crafted HTTP/2 method values, an attacker can cause …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.5%
Last analysed / modified upstream
A flaw was found in find-my-way, a routing module for Node.js. A remote attacker could exploit this vulnerability when find-my-way is used with Node's HTTP/2 server. By sending specially crafted HTTP/2 method values, an attacker can cause the application to crash, leading to a Denial of Service (DoS). This prevents legitimate users from accessing the service.
find-my-way: find-my-way: Denial of Service vulnerability in HTTP/2 server — rated Important by Red Hat. Released 2026-07-28, updated 2026-10-19.
Affected:
Fixed:
No fix planned:
Not affected:
Before you apply this update, make sure all previously released errata that are relevant to your system are applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:60387 Before you apply this update, make sure all previously released errata that are relevant to your system are applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:60390 Before you apply this update, make sure all previously released errata that are relevant to your system are applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:60388
Workarounds / mitigations:
Affected packages:
find-my-way <= 9.6.0Patched in:
find-my-way 9.7.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-45623High· 7.5postcss: PostCSS: Information disclosure and denial of service via crafted CSS input (CVE-2026-45623)
CVE-2026-19481High· 7.5fastify/busboy: fastify/busboy: Denial of Service from crafted form-data headers (CVE-2026-19481)
CVE-2026-19484High· 7.5fastify/busboy: fastify/busboy: Denial of Service via oversized multipart boundary (CVE-2026-19484)
CVE-2026-19693High· 8.1extract-zip: extract-zip: Arbitrary file write via symlink in archive (CVE-2026-19693)
CVE-2026-18446High· 7.5fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority (CVE-2026-18446)
CVE-2026-55685Medium· 6.5react-router: @remix-run/server-runtime: React Router: Denial of Service via unauthenticated manifest endpoint requests (CVE-2026-55685)