Security: find-my-way <=9.6.0 DDoS vulnerability via HTTP/2 — update router dependency

[LucasMaupin]

Summary

find-my-way is Fastify's core HTTP router and is a production runtime dependency. Versions ≤9.6.0 contain a DDoS vulnerability exploitable via HTTP/2 requests.

The backend lockfile currently pins find-my-way@9.3.0 (vulnerable range).

Vulnerability Details

• Package: find-my-way
• Vulnerable range: <=9.6.0
• Severity: High
• Type: Denial of Service via HTTP/2
• CVSS: High severity
• Dependency path: fastify → find-my-way

Risk

An attacker can send crafted HTTP/2 requests to exhaust server resources and cause a denial of service on the intercom-manager API. This affects all API endpoints including /api/v1/production*, WHIP, and WHEP routes.

Recommendation

Update fastify to a version that pulls in find-my-way@>=9.7.0. Since find-my-way is a transitive dependency of fastify, upgrading fastify itself is the correct fix path:

npm install fastify@latest

Verify the fix:

npm audit --audit-level=high

Related Issues

• Security: Run npm audit fix to address 7 high + 8 moderate dependency vulnerabilities #227 — umbrella npm audit fix issue
• Security: Remaining Fastify CVEs — malformed Content-Type bypass (GHSA-573f-x89g-hqp9) and X-Forwarded-Proto host spoofing (GHSA-444r-cwp2-x5xf) #255 — other Fastify CVEs
• Security: High-severity npm vulnerabilities in transitive deps — flatted, lodash, minimatch, picomatch, glob #231 — other transitive dep vulnerabilities

[birme]

daily-backlog-pr: this bump is already applied by open PR #273 (green CI). Linking that PR to close this issue on merge rather than opening a duplicate; moving to In review.