The vulnerability arises from improper handling of HTTP/2 method names inside the router’s lookup mechanism. The router forwards the request method into a Radix Tree lookup, and since the internal tree storage is a plain object, special method names such as constructor, toString, or __proto__ can reference inherited properties. When these values are treated as router nodes, the code dereferences a missing property, causing a crash and a denial of service. This is a classic input validation weakness (CWE-20) combined with potential boundary errors (CWE-248). The impact is a remote denial of service that can be triggered by any client over HTTP/2.

The affected library is find‑my‑way, versions prior to 9.7.0. The issue exists when the router is used behind Node’s native HTTP/2 server. Production deployments using any older version of the library exposed to external traffic can be affected. The vulnerability was fixed in version 9.0.7, and subsequent releases such as 9.7.0 also contain the patch.

The CVSS score of 7.5 indicates a moderate‑to‑high severity, and the low EPSS (<1%) suggests that attacks are currently uncommon but not impossible. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs to establish a connection over HTTP/2 and send a request using a crafted method name such as constructor to trigger the crash. No authentication or special privileges are required, and the attack can be performed from any external network, giving widespread impact to services vulnerable to the router.