What’s Vulnerable › Vulnerabilities

CVE-2019-15606

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 20.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-02-07 · updated 2026-06-17
• Weakness: CWE-20

Description

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

Affected products

• Debian Linux: 10.0
• Node.js: from 10.0.0 before 10.19.0; from 12.0.0 before 12.15.0; from 13.0.0 before 13.8.0 — fixed in 10.19.0, 12.15.0, 13.8.0
• openSUSE Leap: 15.1
• Oracle Communications Cloud Native Core Network Function Cloud Native Environment: 1.4.0
• Oracle Corporation GraalVM Enterprise Edition: 19.3.1, 20.0.0
• Red Hat Enterprise Linux: 8.0
• RedHat Enterprise Linux Eus: 8.1

How to fix

Upgrade to a fixed version: Node.js 10.19.0, 12.15.0, 13.8.0. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html
• https://access.redhat.com/errata/RHSA-2020:0573
• https://access.redhat.com/errata/RHSA-2020:0579
• https://access.redhat.com/errata/RHSA-2020:0597
• https://access.redhat.com/errata/RHSA-2020:0598
• https://access.redhat.com/errata/RHSA-2020:0602
• https://hackerone.com/reports/730779
• https://nodejs.org/en/blog/release/v10.19.0/
• https://nodejs.org/en/blog/release/v12.15.0/
• https://nodejs.org/en/blog/release/v13.8.0/
• https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/
• https://security.gentoo.org/glsa/202003-48

Get alerted when CVE-2019-15606 or the next vulnerability affects your stack