AIKIDO-2026-525916

TL;DR

The router stores its method trees in a plain JavaScript object and looks them up with this.trees[method] using the incoming request method. When find-my-way is used behind a Node.js HTTP/2 server, a request can supply method values such as constructor, toString, or __proto__, which resolve to inherited object properties instead of returning undefined. The router then treats the inherited property as a route node and throws when it reads currentNode.prefix.length, crashing the server process. The fix creates the method tree object with a null prototype so unknown methods resolve to undefined and fall through to the default route.