--- id: CVE-2026-47219 title: >- find-my-way: find-my-way: Denial of Service vulnerability in HTTP/2 server (CVE-2026-47219) summary: >- A flaw was found in find-my-way, a routing module for Node.js. A remote attacker could exploit this vulnerability when find-my-way is used with Node's HTTP/2 server. By sending specially crafted HTTP/2 method values, an attacker can cause … severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cvssSource: vendor cwe: - CWE-843 - CWE-1321 vendor: Red Hat product: Red Hat OpenShift AI (RHOAI) affected: - enterprise_linux_ai_rhel_ai 3 - openshift_ai_rhoai - advanced_cluster_management_for_kubernetes 2.11 - advanced_cluster_management_for_kubernetes 2.13 - advanced_cluster_management_for_kubernetes 2.14 - advanced_cluster_management_for_kubernetes 2.15 - advanced_cluster_management_for_kubernetes 2.16 - advanced_cluster_management_for_kubernetes 2.17 - openshift_dev_spaces 3.30 - multicluster_engine_for_kubernetes 2.17 - multicluster_engine_for_kubernetes 2.6 - multicluster_engine_for_kubernetes 2.8 - multicluster_engine_for_kubernetes 2.9 patched: - advanced_cluster_management_for_kubernetes 2.11 - advanced_cluster_management_for_kubernetes 2.13 - advanced_cluster_management_for_kubernetes 2.14 - advanced_cluster_management_for_kubernetes 2.15 - advanced_cluster_management_for_kubernetes 2.16 - advanced_cluster_management_for_kubernetes 2.17 - openshift_dev_spaces 3.30 - multicluster_engine_for_kubernetes 2.17 - multicluster_engine_for_kubernetes 2.6 - multicluster_engine_for_kubernetes 2.8 - multicluster_engine_for_kubernetes 2.9 published: '2026-07-28' updated: '2026-09-21' sourceUpdated: '2026-09-21T10:37:46+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47219.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47219.json - url: 'https://access.redhat.com/security/cve/CVE-2026-47219' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2508254' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-47219' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47219' - url: >- https://github.com/delvedor/find-my-way/security/advisories/GHSA-c96f-x56v-gq3h - url: 'https://access.redhat.com/errata/RHSA-2026:60387' - url: 'https://access.redhat.com/errata/RHSA-2026:60390' - url: 'https://access.redhat.com/errata/RHSA-2026:60388' - url: 'https://access.redhat.com/errata/RHSA-2026:60389' - url: 'https://access.redhat.com/errata/RHSA-2026:60391' - url: 'https://access.redhat.com/errata/RHSA-2026:60386' - url: 'https://access.redhat.com/errata/RHSA-2026:68754' - url: 'https://access.redhat.com/errata/RHSA-2026:59593' - url: 'https://access.redhat.com/errata/RHSA-2026:59579' - url: 'https://access.redhat.com/errata/RHSA-2026:59558' - url: 'https://access.redhat.com/errata/RHSA-2026:59559' - url: 'https://github.com/delvedor/find-my-way/pull/434' - url: >- https://github.com/delvedor/find-my-way/commit/cfe3fd6168b5ac1594c0820fb83fce251a533fc1 - url: 'https://github.com/delvedor/find-my-way/releases/tag/v9.7.0' - url: 'https://github.com/advisories/GHSA-c96f-x56v-gq3h' tags: - csaf - vex - red-hat - ghsa - npm epss: 0.0046 epssPercentile: 0.37178 aliases: - GHSA-c96f-x56v-gq3h ecosystem: npm ingestedAt: '2026-07-23T20:19:19.616Z' --- ## Overview A flaw was found in find-my-way, a routing module for Node.js. A remote attacker could exploit this vulnerability when find-my-way is used with Node's HTTP/2 server. By sending specially crafted HTTP/2 method values, an attacker can cause the application to crash, leading to a Denial of Service (DoS). This prevents legitimate users from accessing the service. ## Vendor advisories - **RHSA-2026:60387** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60387) - **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390) - **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388) - **RHSA-2026:60389** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60389) - **RHSA-2026:60391** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60391) - **RHSA-2026:60386** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60386) - **RHSA-2026:68754** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68754) - **RHSA-2026:59593** · Red Hat · fixed in: multicluster engine for Kubernetes 2.17 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59593) - **RHSA-2026:59579** · Red Hat · fixed in: multicluster engine for Kubernetes 2.6 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59579) - **RHSA-2026:59558** · Red Hat · fixed in: multicluster engine for Kubernetes 2.8 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59558) - **RHSA-2026:59559** · Red Hat · fixed in: multicluster engine for Kubernetes 2.9 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59559) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47219.json) **find-my-way: find-my-way: Denial of Service vulnerability in HTTP/2 server** — rated Important by Red Hat. Released 2026-07-28, updated 2026-09-21. Affected: - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) Fixed: - Red Hat Advanced Cluster Management for Kubernetes 2.11 - Red Hat Advanced Cluster Management for Kubernetes 2.13 - Red Hat Advanced Cluster Management for Kubernetes 2.14 - Red Hat Advanced Cluster Management for Kubernetes 2.15 - Red Hat Advanced Cluster Management for Kubernetes 2.16 - Red Hat Advanced Cluster Management for Kubernetes 2.17 - Red Hat OpenShift Dev Spaces 3.30 - multicluster engine for Kubernetes 2.17 - multicluster engine for Kubernetes 2.6 - multicluster engine for Kubernetes 2.8 - multicluster engine for Kubernetes 2.9 No fix planned: - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) Not affected: - Red Hat Advanced Cluster Management for Kubernetes 2.11 - Red Hat Advanced Cluster Management for Kubernetes 2.13 - Red Hat Advanced Cluster Management for Kubernetes 2.14 - Red Hat Advanced Cluster Management for Kubernetes 2.15 - Red Hat Advanced Cluster Management for Kubernetes 2.16 - Red Hat Advanced Cluster Management for Kubernetes 2.17 - Red Hat OpenShift Dev Spaces 3.30 - multicluster engine for Kubernetes 2.17 - multicluster engine for Kubernetes 2.6 - multicluster engine for Kubernetes 2.8 ## Remediation Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:60387 Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:60390 Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:60388 Workarounds / mitigations: - There is no available mitigation for this flaw other than updating the bundled find-my-way library to a fixed version (9.7.0 or later). Where feasible, restricting the affected service to HTTP/1.1 (disabling HTTP/2) removes the attack vector, since the flaw is only reachable through the HTTP/2 request path. ## Package advisory (CVE-2026-47219) Affected packages: - `find-my-way <= 9.6.0` Patched in: - `find-my-way 9.7.0` Source: https://github.com/advisories/GHSA-c96f-x56v-gq3h