CVE-2026-47219

find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The lookup function passes req.method into...

CVE-2026-47219 find-my-way is Vulnerable to DDoS with HTTP2

find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The lookup function passes req.method into...

CVE-2026-47219 find-my-way is Vulnerable to DDoS with HTTP2

find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The lookup function passes req.method into...

EUVD-2026-50084

find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The lookup function passes req.method into...

CVE-2026-47219

find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The lookup function passes req.method into...

CVE-2026-47219

CVE-2026-47219 : The vulnerability affects the find-my-way HTTP router. Versions before 9.7.0 are susceptible to remotely triggerable DoS when used with Node's HTTP/2 server. The issue arises because lookup() passes req.method to find(), and find() indexes this.trees[method]. Since this.trees is ...

PSF-2026-34

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

PT-2026-65499

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Certain functions exhibit quadratic time complexity, denoted as On^2, when processing XML documents containing numerous siblings with the same tag. This occurs...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499-pgp110 CVE-2026-43499 futex PI rtmutex...

PT-2026-64632

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the netfilter ebtables component, the update counters and compat update counters functions forward a user-supplied 32-byte table name to find table lock without NUL-termination. When ...

CVE-2026-64245

In the Linux kernel, the following vulnerability has been resolved: fbdev: modedb: fix a possible UAF in fbfindmode If modeoption is NULL, it is assigned from modeoptionbuf: if !modeoption fbgetoptionsNULL, &modeoptionbuf; modeoption = modeoptionbuf; Later, name is assigned from modeoption: const...

UBUNTU-CVE-2026-64255

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate stamask before ffs in BA session handlers Three BA session handlers use ffsbadata-stamask - 1 to derive a station ID without checking that stamask is non-zero. When stamask is zero, ffs returns 0 and...

EUVD-2026-48654

In the Linux kernel, the following vulnerability has been resolved: fbdev: modedb: fix a possible UAF in fbfindmode If modeoption is NULL, it is assigned from modeoptionbuf: if !modeoption fbgetoptionsNULL, &modeoptionbuf; modeoption = modeoptionbuf; Later, name is assigned from modeoption: const...

CVE-2026-64245 fbdev: modedb: fix a possible UAF in fb_find_mode()

In the Linux kernel, the following vulnerability has been resolved: fbdev: modedb: fix a possible UAF in fbfindmode If modeoption is NULL, it is assigned from modeoptionbuf: if !modeoption fbgetoptionsNULL, &modeoptionbuf; modeoption = modeoptionbuf; Later, name is assigned from modeoption: const...

CVE-2026-16733

A flaw was found in bahmutov find-cypress-specs. A local attacker can exploit a vulnerability in the Branch Handler component by manipulating the '--branch' argument. This manipulation leads to an operating system OS command injection, allowing the attacker to execute arbitrary commands on the...

@depup/prisma (7.9.0-depup.0), @depup/prisma__dev (0.24.14-depup.40) +22 more potentially affected by CVE-2026-47219 via find-my-way (>=9.3.0, <=9.6.0)

find-my-way NPM version =9.3.0, =1.0.3-alpha.0b30e6d.0, =11.1.11, =7.8.0-lossless.12, =0.1.4, =0.2.2, =1.10.0, =11.1.0, =0.7.0, =0.8.0 and more Source cves: CVE-2026-47219 Source advisory: SNYK:JS-FINDMYWAY-18313040...

NPM: find-my-way: DDoS with HTTP2

NPM: find-my-way: DDoS with HTTP2 vulnerability discovered by ? in WordPress Npm find-my-way versions = 9.6.0...

@depup/prisma (7.9.0-depup.0), @depup/prisma__dev (0.24.14-depup.40) +22 more potentially affected by CVE-2026-47219 via find-my-way (>=9.3.0, <=9.6.0)

find-my-way NPM version =9.3.0, =1.0.3-alpha.0b30e6d.0, =11.1.11, =7.8.0-lossless.12, =0.1.4, =0.2.2, =1.10.0, =11.1.0, =0.7.0, =0.8.0 and more Source cves: CVE-2026-47219 Source advisory: OSV:GHSA-C96F-X56V-GQ3H...

find-my-way: DDoS with HTTP2

Impact Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The short version is that lookup passes req.method into find, and find indexes this.treesmethod. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or proto can resolve...

GHSA-C96F-X56V-GQ3H find-my-way: DDoS with HTTP2

Impact Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The short version is that lookup passes req.method into find, and find indexes this.treesmethod. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or proto can resolve...