Update dependency find-my-way to v9 [SECURITY] by renovate[bot] · Pull Request #12273 · redwoodjs/graphql

renovate · 2026-10-03T23:10:07Z

This PR contains the following updates:

Package	Change	Age	Confidence
find-my-way	`8.2.2` → `9.7.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

find-my-way: DDoS with HTTP2

CVE-2026-47219 / GHSA-c96f-x56v-gq3h

More information

Details

Impact

Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server.

The short version is that lookup() passes req.method into find(), and find() indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or __proto__ can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches currentNode.prefix.length.

Patches

Upgrade to v9.7.0.

Workarounds

Do not use find-my-way with HTTP/2 servers, or validate that the http method is valid beforehand.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

delvedor/find-my-way (find-my-way)

`v9.7.0`

Compare Source

What's Changed

fix: backtrack on regex param mismatch by @mcollina in #427
fix: apply root path fallback for optional params in off() by @aquie00t in #428
ci: add node v26 to test matrix by @aquie00t in #435
perf(host): cache regex lookup results in HostStorage by @aquie00t in #436
chore: bump inquirer from 13.4.3 to 14.0.2 in the dev-dependencies group by @dependabot[bot] in #437
chore: bump fastify/github-action-merge-dependabot from 3.12.0 to 3.15.0 by @dependabot[bot] in #438
chore: bump @types/node from 25.9.4 to 26.1.0 in the dev-dependencies group by @dependabot[bot] in #440
fix: prevent done from being called multiple times on async constraint errors by @deepview-autofix in #425
fix: align isParamSafe state in findRoute with _on by @deepview-autofix in #424
chore: bump actions/checkout from 6 to 7 by @dependabot[bot] in #439
fix: avoid crash on undefined regex capture during route lookup by @bianyifan in #441

New Contributors

@aquie00t made their first contribution in #428
@deepview-autofix made their first contribution in #425
@bianyifan made their first contribution in #441

Full Changelog: delvedor/find-my-way@v9.6.0...v9.7.0

`v9.6.0`

Compare Source

What's Changed

chore: bump borp from 0.21.0 to 1.0.0 in the dev-dependencies group by @dependabot[bot] in #419
perf: optimize bitmask handler retrieval using Math.clz32 by @gurgunday in #420
chore: bump fastify/github-action-merge-dependabot from 3.11.2 to 3.12.0 by @dependabot[bot] in #429
chore: bump pre-commit from 1.2.2 to 2.0.0 in the dev-dependencies group by @dependabot[bot] in #430
feat: add onMaxParamLength to support 414 URI Too Long by @oldregime in #432

New Contributors

@oldregime made their first contribution in #432

Full Changelog: delvedor/find-my-way@v9.5.0...v9.6.0

`v9.5.0`

Compare Source

What's Changed

feat: expose path normalization utility methods by @mcollina in #417
fix: ignore inherited constraint keys by @mcollina in #416
feat: expose path utility methods and document them by @mcollina in #418
chore: bump fastify/github-action-merge-dependabot from 3.11.1 to 3.11.2 by @dependabot[bot] in #408

Full Changelog: delvedor/find-my-way@v9.4.0...v9.5.0

`v9.4.0`

Compare Source

What's Changed

chore: bump actions/setup-node from 4.3.0 to 4.4.0 by @dependabot[bot] in #398
chore: bump the dev-dependencies group with 2 updates by @dependabot[bot] in #399
ci(nodejs): add node 24 to test matrix by @Fdawgs in #400
ci: use tags for immutable github actions by @Fdawgs in #401
chore: bump @types/node from 22.15.34 to 24.0.8 in the dev-dependencies group by @dependabot[bot] in #403
chore: bump actions/setup-node from 4 to 6 by @dependabot[bot] in #409
chore: bump the dev-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #410
chore: bump actions/checkout from 4 to 6 by @dependabot[bot] in #412
chore: bump the dev-dependencies group with 2 updates by @dependabot[bot] in #413
feat: expose sanitizeUrlPath by @Eomm in #415

Full Changelog: delvedor/find-my-way@v9.3.0...v9.4.0

`v9.3.0`

Compare Source

What's Changed

Feat/node test runner by @ilteoood in #381
chore: prefer charCodeAt by @gurgunday in #384
perf: improve string operations by @gurgunday in #382
chore: bump the dev-dependencies group with 4 updates by @dependabot in #385
chore: bump fastify/github-action-merge-dependabot from 3.10.1 to 3.11.0 by @dependabot in #386
chore: add typings for query string parser by @vwong in #387
perf: use map for sting-based stores by @gurgunday in #383
chore: bump safe-regex2 from 4.0.1 to 5.0.0 in the dependencies-major group by @dependabot in #390
ci(node.js): update workflow by @Fdawgs in #392
build(dependabot): reduce npm updates to monthly by @Fdawgs in #394
chore(package): explicitly declare js module type by @Fdawgs in #391
chore: bump fastify/github-action-merge-dependabot from 3.11.0 to 3.11.1 by @dependabot in #395
chore(package): update engines.node to >=20 by @Fdawgs in #397
ci(node.js): pin actions to commit-hash by @Fdawgs in #396
fix: missing the param done of lookup method by @zhennann in #389
perf: refactor escapeRegExp and removeDuplicateSlashes functions by @DarkGL in #388