Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| find-my-way | npm | <= 9.6.0 | 9.7.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a prototype pollution issue in the find-my-way library, which can be triggered by a remote attacker to cause a denial of service. The root cause lies in the initialization of this.trees as a plain JavaScript object ({}) in the Router constructor and the reset function. This means this.trees inherits properties from Object.prototype.
The lookup function takes an HTTP request and calls the find function, passing the request's method. The find function then uses this method as a key to access this.trees (e.g., this.trees[method]). When used with an HTTP/2 server, an attacker can send a request with a method like constructor, toString, or __proto__. This tricks the find function into accessing properties of Object.prototype instead of a router tree. The code then attempts to access properties of this inherited value as if it were a valid router node, leading to a TypeError and crashing the application.
The patch addresses this by changing the initialization of this.trees to Object.create(null). This creates an object with no prototype, so it doesn't inherit any properties, effectively preventing the prototype pollution attack. The vulnerable functions are Router.prototype.find (where the crash occurs), Router.prototype.lookup (the entry point for the malicious input), and the Router constructor and Router.prototype.reset (where the vulnerable object is created).
Router.prototype.findindex.js
Router.prototype.lookupindex.js
Routerindex.js
Router.prototype.resetindex.js