p PatchFirst

CVE-2019-15606

CVE-2019-15606

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

CVSS 9.8 · Critical · EPSS 20.0% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • node.js

    Versions
    • ≥ 4.0, < 4.*: Affected (semver)
    • ≥ 5.0, < 5.*: Affected (semver)
    • ≥ 6.0, < 6.*: Affected (semver)
    • ≥ 7.0, < 7.*: Affected (semver)
    • ≥ 8.0, < 8.*: Affected (semver)
    • ≥ 9.0, < 9.*: Affected (semver)
    • ≥ 10.0, < 10.19.0: Affected (semver)
    • ≥ 11.0, < 11.*: Affected (semver)
    • ≥ 12.0, < 12.15.0: Affected (semver)
    • ≥ 13.0, < 13.8.0: Affected (semver)

    Update to 10.19.0; Update to 12.15.0; Update to 13.8.0

  • nodejs Debian:12

    Affected ranges
    • ECOSYSTEM: < 10.19.0~dfsg-1

    Update to 10.19.0~dfsg-1

  • nodejs Debian:13

    Affected ranges
    • ECOSYSTEM: < 10.19.0~dfsg-1

    Update to 10.19.0~dfsg-1

  • nodejs Debian:14

    Affected ranges
    • ECOSYSTEM: < 10.19.0~dfsg-1

    Update to 10.19.0~dfsg-1

  • nodejs Ubuntu:Pro:14.04:LTS

    Versions
    • 0.10.15~dfsg1-4
    • 0.10.21~dfsg1-1
    • 0.10.22~dfsg1-2
    • 0.10.23~dfsg1-1
    • 0.10.23~dfsg1-2
    • 0.10.23~dfsg1-3
    • 0.10.24~dfsg1-1
    • 0.10.25~dfsg2-2
    • 0.10.25~dfsg2-2ubuntu1
    • 0.10.25~dfsg2-2ubuntu1.2
    • 0.10.25~dfsg2-2ubuntu1.2+esm1
    • 0.10.25~dfsg2-2ubuntu1.2+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nodejs Ubuntu:Pro:16.04:LTS

    Versions
    • 0.10.25~dfsg2-2ubuntu1
    • 4.2.2~dfsg-1
    • 4.2.3~dfsg-1
    • 4.2.4~dfsg-1ubuntu1
    • 4.2.4~dfsg-2
    • 4.2.6~dfsg-1ubuntu1
    • 4.2.6~dfsg-1ubuntu4
    • 4.2.6~dfsg-1ubuntu4.1
    • 4.2.6~dfsg-1ubuntu4.2
    • 4.2.6~dfsg-1ubuntu4.2+esm1
    Affected ranges
    • ECOSYSTEM: < 4.2.6~dfsg-1ubuntu4.2+esm2

    Update to 4.2.6~dfsg-1ubuntu4.2+esm2

  • nodejs Ubuntu:Pro:18.04:LTS

    Versions
    • 6.11.4~dfsg-1ubuntu1
    • 6.11.4~dfsg-1ubuntu2
    • 6.12.0~dfsg-1ubuntu1
    • 6.12.0~dfsg-2ubuntu1
    • 6.12.0~dfsg-2ubuntu2
    • 8.10.0~dfsg-2
    • 8.10.0~dfsg-2ubuntu0.2
    • 8.10.0~dfsg-2ubuntu0.3
    • 8.10.0~dfsg-2ubuntu0.4
    • 8.10.0~dfsg-2ubuntu0.4+esm1
    Affected ranges
    • ECOSYSTEM: < 8.10.0~dfsg-2ubuntu0.4+esm2

    Update to 8.10.0~dfsg-2ubuntu0.4+esm2

Original sources

Check your server →