CVE-2019-15605
CVE-2019-15605
This page contains facts from public vulnerability sources. Check the original advisory before updating.
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
CVSS 9.8 · Critical · EPSS 57.1% · Fix available
- Published
- Updated
Affected products and versions
node.js
- Versions
- ≥ 4.0, < 4.*: Affected (semver)
- ≥ 5.0, < 5.*: Affected (semver)
- ≥ 6.0, < 6.*: Affected (semver)
- ≥ 7.0, < 7.*: Affected (semver)
- ≥ 8.0, < 8.*: Affected (semver)
- ≥ 9.0, < 9.*: Affected (semver)
- ≥ 10.0, < 10.19.0: Affected (semver)
- ≥ 11.0, < 11.*: Affected (semver)
- ≥ 12.0, < 12.15.0: Affected (semver)
- ≥ 13.0, < 13.8.0: Affected (semver)
Update to 10.19.0; Update to 12.15.0; Update to 13.8.0
http-parser Debian:12
- Affected ranges
- ECOSYSTEM: < 2.9.4-2
Update to 2.9.4-2
http-parser Debian:13
- Affected ranges
- ECOSYSTEM: < 2.9.4-2
Update to 2.9.4-2
http-parser Debian:14
- Affected ranges
- ECOSYSTEM: < 2.9.4-2
Update to 2.9.4-2
nodejs Debian:12
- Affected ranges
- ECOSYSTEM: < 10.19.0~dfsg-1
Update to 10.19.0~dfsg-1
nodejs Debian:13
- Affected ranges
- ECOSYSTEM: < 10.19.0~dfsg-1
Update to 10.19.0~dfsg-1
nodejs Debian:14
- Affected ranges
- ECOSYSTEM: < 10.19.0~dfsg-1
Update to 10.19.0~dfsg-1
nodejs Ubuntu:Pro:14.04:LTS
- Versions
- 0.10.15~dfsg1-4
- 0.10.21~dfsg1-1
- 0.10.22~dfsg1-2
- 0.10.23~dfsg1-1
- 0.10.23~dfsg1-2
- 0.10.23~dfsg1-3
- 0.10.24~dfsg1-1
- 0.10.25~dfsg2-2
- 0.10.25~dfsg2-2ubuntu1
- 0.10.25~dfsg2-2ubuntu1.2
- 0.10.25~dfsg2-2ubuntu1.2+esm1
- 0.10.25~dfsg2-2ubuntu1.2+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nodejs Ubuntu:Pro:16.04:LTS
- Versions
- 0.10.25~dfsg2-2ubuntu1
- 4.2.2~dfsg-1
- 4.2.3~dfsg-1
- 4.2.4~dfsg-1ubuntu1
- 4.2.4~dfsg-2
- 4.2.6~dfsg-1ubuntu1
- 4.2.6~dfsg-1ubuntu4
- 4.2.6~dfsg-1ubuntu4.1
- 4.2.6~dfsg-1ubuntu4.2
- 4.2.6~dfsg-1ubuntu4.2+esm1
- Affected ranges
- ECOSYSTEM: < 4.2.6~dfsg-1ubuntu4.2+esm2
Update to 4.2.6~dfsg-1ubuntu4.2+esm2
nodejs Ubuntu:Pro:18.04:LTS
- Versions
- 6.11.4~dfsg-1ubuntu1
- 6.11.4~dfsg-1ubuntu2
- 6.12.0~dfsg-1ubuntu1
- 6.12.0~dfsg-2ubuntu1
- 6.12.0~dfsg-2ubuntu2
- 8.10.0~dfsg-2
- 8.10.0~dfsg-2ubuntu0.2
- 8.10.0~dfsg-2ubuntu0.3
- 8.10.0~dfsg-2ubuntu0.4
- 8.10.0~dfsg-2ubuntu0.4+esm1
- Affected ranges
- ECOSYSTEM: < 8.10.0~dfsg-2ubuntu0.4+esm2
Update to 8.10.0~dfsg-2ubuntu0.4+esm2
Original sources
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLB676PDU4RJQLWQUA277YNGYYNEYGWO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CT3WTR4P5VAJ3GJGKPYEDUPTNZ3IEDUR/
- https://access.redhat.com/errata/RHSA-2020:0573
- https://access.redhat.com/errata/RHSA-2020:0579
- https://access.redhat.com/errata/RHSA-2020:0597
- https://access.redhat.com/errata/RHSA-2020:0598
- https://access.redhat.com/errata/RHSA-2020:0602
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html
- https://access.redhat.com/errata/RHSA-2020:0703
- https://access.redhat.com/errata/RHSA-2020:0707
- https://access.redhat.com/errata/RHSA-2020:0708
- https://security.gentoo.org/glsa/202003-48
- https://www.debian.org/security/2020/dsa-4669
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://nodejs.org/en/blog/release/v13.8.0/
- https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/
- https://nodejs.org/en/blog/release/v10.19.0/
- https://nodejs.org/en/blog/release/v12.15.0/
- https://security.netapp.com/advisory/ntap-20200221-0004/
- https://hackerone.com/reports/735748
- https://nvd.nist.gov/vuln/detail/CVE-2019-15605