{"id":"CVE-2020-7764","aliases":["GHSA-jgrh-5m3h-9c5f","SNYK-JS-FINDMYWAY-1038269"],"url":"https://o3.security/vulnerability/CVE-2020-7764","summary":"Web Cache Poisoning in find-my-way","details":"This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed header in a cache poisoning attack.","published":"2020-11-08T16:15:12.183Z","modified":"2026-08-07T15:14:53.675331Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"find-my-way","fixedVersion":"2.2.5"},{"ecosystem":"npm","name":"find-my-way","fixedVersion":"3.0.5"}],"fix":{"url":"https://github.com/delvedor/find-my-way/commit/ab408354690e6b9cf3c4724befb3b3fa4bb90aac","label":"delvedor/find-my-way@ab40835"},"references":[{"type":"ADVISORY","url":"https://snyk.io/vuln/SNYK-JS-FINDMYWAY-1038269"},{"type":"FIX","url":"https://github.com/delvedor/find-my-way/commit/ab408354690e6b9cf3c4724befb3b3fa4bb90aac"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T15:14:53.675331Z"}}