GHSA-c96f-x56v-gq3h
find-my-way: DDoS with HTTP2
Quick fix
GHSA-c96f-x56v-gq3h — find-my-way: upgrade to the fixed version with the command below.
npm install find-my-way@9.7.0Details
### Impact Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server.
The short version is that `lookup()` passes `req.method` into `find()`, and `find()` indexes `this.trees[method]`. Since `this.trees` is a normal object, HTTP/2 method values like constructor, `toString`, or `__proto__` can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches `currentNode.prefix.length`.
### Patches
Upgrade to v9.7.0.
### Workarounds
Do not use find-my-way with HTTP/2 servers, or validate that the http method is valid beforehand.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/delvedor/find-my-way/security/advisories/GHSA-c96f-x56v-gq3h [WEB]
- https://github.com/delvedor/find-my-way/pull/434 [WEB]
- https://github.com/delvedor/find-my-way/commit/cfe3fd6168b5ac1594c0820fb83fce251a533fc1 [WEB]
- https://github.com/delvedor/find-my-way [PACKAGE]
- https://github.com/delvedor/find-my-way/releases/tag/v9.7.0 [WEB]