CVE-2019-15606
Critical
Description
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
SeverityCritical
CVSS9.8
Exploit probability97. percentile20%
Product
Nodejs Node.js
PublishedFeb 7, 2020
First seenFeb 7, 2020
Weakness typeCWE-20Improper input validation
How to fix
Update
- nodejs node.js10.19.0, 12.15.0, 13.8.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nodejs node.js | 10.0.0 ≤ v < 10.19.0, 12.0.0 ≤ v < 12.15.0, 13.0.0 ≤ v < 13.8.0 | 10.19.0, 12.15.0, 13.8.0 |
| oracle communications_cloud_native_core_network_function_cloud_native_environment | 1.4.0 | — |
| oracle graalvm | 19.3.1, 20.0.0 | — |
| debian debian_linux | 10.0 | — |
| redhat enterprise_linux | 8.0 | — |
| redhat enterprise_linux_eus | 8.1 | — |
| opensuse leap | 15.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.