3vulnerabilities
- Critical0 (0.0%)
- High2 (66.7%)
- Medium0 (0.0%)
- Moderate1 (33.3%)
- Low0 (0.0%)
find-my-way
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 2HighAffects 3 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 2 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (3)
Known vulnerabilities affecting find-my-way, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-c96f-x56v-gq3h | High | find-my-way: DDoS with HTTP2### Impact Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The short version is that `lookup()` passes `req.method` into `find()`, and `find()` indexes `this.trees[method]`. Since `this.trees` is a normal object, HTTP/2 method values like constructor, `toString`, or `__proto__` can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches `currentNode.prefix.length`. ### Patches Upgrade to v9.7.0. ### Workarounds Do not use find-my-way with HTTP/2 servers, or validat |
| GitHub (opens in a new tab) | |
| GHSA-rrr8-f88r-h8q6 | High | find-my-way has a ReDoS vulnerability in multiparametric routes### Impact A bad regular expression is generated any time you have two parameters within a single segment, when adding a `-` at the end, like `/:a-:b-`. ### Patches Update to find-my-way v8.2.2 or v9.0.1. or subsequent versions. ### Workarounds No known workarounds. ### References - [CVE-2024-45296](https://github.com/advisories/GHSA-9wv6-86v2-598j) - [Detailed blog post about `path-to-regexp` vulnerability](https://blakeembrey.com/posts/2024-09-web-redos/) |
| GitHub (opens in a new tab) | |
| GHSA-jgrh-5m3h-9c5f | Moderate | Web Cache Poisoning in find-my-wayThis affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed header in a cache poisoning attack. |
| GitHub (opens in a new tab) |
### Impact Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The short version is that `lookup()` passes `req.method` into `find()`, and `find()` indexes `this.trees[method]`. Since `this.trees` is a normal object, HTTP/2 method values like constructor, `toString`, or `__proto__` can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches `currentNode.prefix.length`. ### Patches Upgrade to v9.7.0. ### Workarounds Do not use find-my-way with HTTP/2 servers, or validat
CVE: CVE-2026-47219
- GHSA-rrr8-f88r-h8q6Highfind-my-way has a ReDoS vulnerability in multiparametric routes
>= 5.5.0, < 8.2.2>= 9.0.0, < 9.0.1
### Impact A bad regular expression is generated any time you have two parameters within a single segment, when adding a `-` at the end, like `/:a-:b-`. ### Patches Update to find-my-way v8.2.2 or v9.0.1. or subsequent versions. ### Workarounds No known workarounds. ### References - [CVE-2024-45296](https://github.com/advisories/GHSA-9wv6-86v2-598j) - [Detailed blog post about `path-to-regexp` vulnerability](https://blakeembrey.com/posts/2024-09-web-redos/)
CVE: CVE-2024-45813
- GHSA-jgrh-5m3h-9c5fModerateWeb Cache Poisoning in find-my-way
< 2.2.5>= 3.0.0, < 3.0.5
This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed header in a cache poisoning attack.
CVE: CVE-2020-7764