{"id":"CVE-2026-47219","title":"find-my-way: find-my-way: Denial of Service vulnerability in HTTP/2 server (CVE-2026-47219)","summary":"A flaw was found in find-my-way, a routing module for Node.js. A remote attacker could exploit this vulnerability when find-my-way is used with Node's HTTP/2 server. By sending specially crafted HTTP/2 method values, an attacker can cause …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-843","CWE-1321"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","advanced_cluster_management_for_kubernetes 2.11","advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_management_for_kubernetes 2.14","advanced_cluster_management_for_kubernetes 2.15","advanced_cluster_management_for_kubernetes 2.16","advanced_cluster_management_for_kubernetes 2.17","openshift_dev_spaces 3.30","multicluster_engine_for_kubernetes 2.17","multicluster_engine_for_kubernetes 2.6","multicluster_engine_for_kubernetes 2.8","multicluster_engine_for_kubernetes 2.9"],"patched":["advanced_cluster_management_for_kubernetes 2.11","advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_management_for_kubernetes 2.14","advanced_cluster_management_for_kubernetes 2.15","advanced_cluster_management_for_kubernetes 2.16","advanced_cluster_management_for_kubernetes 2.17","openshift_dev_spaces 3.30","multicluster_engine_for_kubernetes 2.17","multicluster_engine_for_kubernetes 2.6","multicluster_engine_for_kubernetes 2.8","multicluster_engine_for_kubernetes 2.9"],"published":"2026-07-28","updated":"2026-09-21","sourceUpdated":"2026-09-21T10:37:46+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47219.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47219.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-47219"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508254"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47219"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47219"},{"url":"https://github.com/delvedor/find-my-way/security/advisories/GHSA-c96f-x56v-gq3h"},{"url":"https://access.redhat.com/errata/RHSA-2026:60387"},{"url":"https://access.redhat.com/errata/RHSA-2026:60390"},{"url":"https://access.redhat.com/errata/RHSA-2026:60388"},{"url":"https://access.redhat.com/errata/RHSA-2026:60389"},{"url":"https://access.redhat.com/errata/RHSA-2026:60391"},{"url":"https://access.redhat.com/errata/RHSA-2026:60386"},{"url":"https://access.redhat.com/errata/RHSA-2026:68754"},{"url":"https://access.redhat.com/errata/RHSA-2026:59593"},{"url":"https://access.redhat.com/errata/RHSA-2026:59579"},{"url":"https://access.redhat.com/errata/RHSA-2026:59558"},{"url":"https://access.redhat.com/errata/RHSA-2026:59559"},{"url":"https://github.com/delvedor/find-my-way/pull/434"},{"url":"https://github.com/delvedor/find-my-way/commit/cfe3fd6168b5ac1594c0820fb83fce251a533fc1"},{"url":"https://github.com/delvedor/find-my-way/releases/tag/v9.7.0"},{"url":"https://github.com/advisories/GHSA-c96f-x56v-gq3h"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.00263,"epssPercentile":0.18414,"aliases":["GHSA-c96f-x56v-gq3h"],"ecosystem":"npm","ingestedAt":"2026-07-23T20:19:19.616Z","slug":"CVE-2026-47219","body":"## Overview\n\nA flaw was found in find-my-way, a routing module for Node.js. A remote attacker could exploit this vulnerability when find-my-way is used with Node's HTTP/2 server. By sending specially crafted HTTP/2 method values, an attacker can cause the application to crash, leading to a Denial of Service (DoS). This prevents legitimate users from accessing the service.\n\n## Vendor advisories\n\n- **RHSA-2026:60387** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60387)\n- **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390)\n- **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388)\n- **RHSA-2026:60389** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60389)\n- **RHSA-2026:60391** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60391)\n- **RHSA-2026:60386** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60386)\n- **RHSA-2026:68754** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68754)\n- **RHSA-2026:59593** · Red Hat · fixed in: multicluster engine for Kubernetes 2.17 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59593)\n- **RHSA-2026:59579** · Red Hat · fixed in: multicluster engine for Kubernetes 2.6 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59579)\n- **RHSA-2026:59558** · Red Hat · fixed in: multicluster engine for Kubernetes 2.8 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59558)\n- **RHSA-2026:59559** · Red Hat · fixed in: multicluster engine for Kubernetes 2.9 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59559)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47219.json)\n\n**find-my-way: find-my-way: Denial of Service vulnerability in HTTP/2 server** — rated Important by Red Hat. Released 2026-07-28, updated 2026-09-21.\n\nAffected:\n\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\nFixed:\n\n- Red Hat Advanced Cluster Management for Kubernetes 2.11\n- Red Hat Advanced Cluster Management for Kubernetes 2.13\n- Red Hat Advanced Cluster Management for Kubernetes 2.14\n- Red Hat Advanced Cluster Management for Kubernetes 2.15\n- Red Hat Advanced Cluster Management for Kubernetes 2.16\n- Red Hat Advanced Cluster Management for Kubernetes 2.17\n- Red Hat OpenShift Dev Spaces 3.30\n- multicluster engine for Kubernetes 2.17\n- multicluster engine for Kubernetes 2.6\n- multicluster engine for Kubernetes 2.8\n- multicluster engine for Kubernetes 2.9\n\nNo fix planned:\n\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\nNot affected:\n\n- Red Hat Advanced Cluster Management for Kubernetes 2.11\n- Red Hat Advanced Cluster Management for Kubernetes 2.13\n- Red Hat Advanced Cluster Management for Kubernetes 2.14\n- Red Hat Advanced Cluster Management for Kubernetes 2.15\n- Red Hat Advanced Cluster Management for Kubernetes 2.16\n- Red Hat Advanced Cluster Management for Kubernetes 2.17\n- Red Hat OpenShift Dev Spaces 3.30\n- multicluster engine for Kubernetes 2.17\n- multicluster engine for Kubernetes 2.6\n- multicluster engine for Kubernetes 2.8\n\n## Remediation\n\nBefore you apply this update, make sure all previously released errata\nthat are relevant to your system are applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:60387\nBefore you apply this update, make sure all previously released errata\nthat are relevant to your system are applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:60390\nBefore you apply this update, make sure all previously released errata\nthat are relevant to your system are applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:60388\n\nWorkarounds / mitigations:\n\n- There is no available mitigation for this flaw other than updating the bundled find-my-way library to a fixed version (9.7.0 or later). Where feasible, restricting the affected service to HTTP/1.1 (disabling HTTP/2) removes the attack vector, since the flaw is only reachable through the HTTP/2 request path.\n\n## Package advisory (CVE-2026-47219)\n\nAffected packages:\n\n- `find-my-way <= 9.6.0`\n\nPatched in:\n\n- `find-my-way 9.7.0`\n\nSource: https://github.com/advisories/GHSA-c96f-x56v-gq3h","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}