Description
find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework independent. A bad regular expression is generated any time one has two parameters within a single segment, when adding a `-` at the end, like `/:a-:b-`. This may cause a denial of service in some instances. Users are advised to update to find-my-way v8.2.2 or v9.0.1. or subsequent versions. There are no known workarounds for this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| delvedor | find-my-way | < 8.2.2, = 9.0.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | find-my-way | >= 5.5.0, < 8.2.2 | 8.2.2 | GHSA-rrr8-f88r-h8q6 |
| npm | find-my-way | >= 9.0.0, < 9.0.1 | 9.0.1 | GHSA-rrr8-f88r-h8q6 |
Advisories 2
- WID-SEC-2024-3542 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 5, 2026
- WID-SEC-2024-3733 Red Hat Advanced Cluster Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 4, 2025