CVE-2019-15606 in the critical feed json
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparis…
published 6y ago modified 4mo ago also EUVD-2019-6566
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 20.0%
- EPSS 20.0% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
Patch / fix
- NodeJS Node 10.19.0, 12.15.0, 13.8.0
- nodejs Debian 14, Debian 13, Debian 12 10.19.0~dfsg-1
debian advisories DEBIAN-CVE-2019-15606
- nodejs Ubuntu Pro 16.04 LTS 4.2.6~dfsg-1ubuntu4.2+esm2
- nodejs Ubuntu Pro 18.04 LTS 8.10.0~dfsg-2ubuntu0.4+esm2
ubuntu advisories UBUNTU-CVE-2019-15606
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- npm RHEL 8 1:6.13.4-1.12.16.1.1.module+el8.1.0+5811+44509afe
- nodejs RHEL 8 1:12.16.1-1.module+el8.1.0+5811+44509afe
- nodejs-nodemon RHEL 8 1.18.3-1.module+el8.1.0+3369+37ae6a45
- nodejs-packaging RHEL 8 17-3.module+el8.1.0+3369+37ae6a45
- npm RHEL 8 1:6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c
- nodejs RHEL 8 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
- nodejs-nodemon RHEL 8, RHEL 8.0 E4S 1.18.3-1.module+el8+2632+6c5111ed
- nodejs-packaging RHEL 8, RHEL 8.0 E4S 17-3.module+el8+2873+aa7dfd9a
red hat advisories RHSA-2020:0598RHSA-2020:0579RHSA-2020:0597RHSA-2020:0573RHSA-2020:0602
- nodejs6 SLE Module for Web and Scripting 12, OpenStack Cloud Crowbar 9, OpenStack Cloud Crowbar 8 +1 more 6.17.1-11.33.1
- nodejs10 SLE Module for Web and Scripting 15 SP1, SLE Module for Web and Scripting 15, SLE Module for Web and Scripting 12 +4 more 10.19.0-1.18.1
- nodejs8 SLES for SAP 15, SLES 15-LTSS, SLE Module for Web and Scripting 15 SP1 +3 more 8.17.0-3.28.1
- nodejs12 SLE Module for Web and Scripting 12 12.15.0-1.6.1
suse advisories SUSE-SU-2020:0488-1SUSE-SU-2020:0455-1SUSE-SU-2020:0454-1SUSE-SU-2020:0429-1SUSE-SU-2020:0427-1
- nodejs8 openSUSE Leap 15.1 8.17.0-lp151.2.12.1
opensuse advisories openSUSE-SU-2020:0293-1
- nodejs-nodemon AlmaLinux 8 1.18.3-1.module_el8.3.0+2023+d2377ea3
- nodejs-nodemon AlmaLinux 8 1.18.3-1.module_el8.3.0+2047+b07ac28e
- nodejs-packaging AlmaLinux 8 17-3.module_el8.4.0+2224+b07ac28e
- nodejs-packaging AlmaLinux 8 17-3.module_el8.4.0+2521+c668cc9f
- nodejs-packaging AlmaLinux 8 17-3.module_el8.3.0+2023+d2377ea3
almalinux advisories ALSA-2020:0598ALSA-2020:0579
- nodejs-nodemon Rocky Linux 8 1.18.3-1.module+el8.3.0+101+f84c7154
- nodejs-packaging Rocky Linux 8 17-3.module+el8.3.0+101+f84c7154
rocky linux advisories RLSA-2020:0598RLSA-2020:0579
- nodejs Alpine 3.10, Alpine 3.9 10.19.0-r0
- nodejs Alpine 3.24, Alpine 3.23, Alpine 3.22 +11 more 12.15.0-r0
- nodejs-current Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 13.11.0-r0
alpine advisories ALPINE-CVE-2019-15606
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Is CVE-2019-15606 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2019-15606 updated cvss 4.8
nodejs: HTTP header values do not have trailing optional whitespace trimmed
-
Red Hat Enterprise Linux AppStream (v. 8) nodejs 10.19.0-1.module+el8.1.0+5726+6ed65f8c, nodejs 12.16.1-1.module+el8.1.0+5811+44509afe, nodejs-packaging 17-3.module+el8+2873+aa7dfd9a, nodejs-nodemon 1.18.3-1.module+el8+2632+6c5111ed, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, npm 6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c, +2 morefixed: vendor fix RHSA-2020:0579
-
Red Hat Enterprise Linux AppStream E4S (v. 8.0) nodejs 10.19.0-1.module+el8.0.0+5738+1362a79c, nodejs-packaging 17-3.module+el8+2873+aa7dfd9a, nodejs-nodemon 1.18.3-1.module+el8+2632+6c5111ed, npm 6.13.4-1.10.19.0.1.module+el8.0.0+5738+1362a79cfixed: vendor fix RHSA-2020:0573
-
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs10-nodejs 10.19.0-1.el7, rh-nodejs12-nodejs 12.16.1-1.el7, rh-nodejs10-npm 6.13.4-10.19.0.1.el7, rh-nodejs12-npm 6.13.4-12.16.1.1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nodejs10-nodejs 10.19.0-1.el7, rh-nodejs12-nodejs 12.16.1-1.el7, rh-nodejs10-npm 6.13.4-10.19.0.1.el7, rh-nodejs12-npm 6.13.4-12.16.1.1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs10-nodejs 10.19.0-1.el7, rh-nodejs12-nodejs 12.16.1-1.el7, rh-nodejs10-npm 6.13.4-10.19.0.1.el7, rh-nodejs12-npm 6.13.4-12.16.1.1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs10-nodejs 10.19.0-1.el7, rh-nodejs12-nodejs 12.16.1-1.el7, rh-nodejs10-npm 6.13.4-10.19.0.1.el7, rh-nodejs12-npm 6.13.4-12.16.1.1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs10-nodejs 10.19.0-1.el7, rh-nodejs12-nodejs 12.16.1-1.el7, rh-nodejs10-npm 6.13.4-10.19.0.1.el7, rh-nodejs12-npm 6.13.4-12.16.1.1.el7fixed: vendor fix RHSA-2020:0597
-
Red Hat Quay 3 nodejsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
20.04% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- hackerone.com https://hackerone.com/reports/730779 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- NodeJS Node
Classification
- Weakness
-
- CWE-20 Improper Input Validation
- Technology feeds
References
-
hackerone.com
/reports/730779
exploit, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0573
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0579
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0597
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0598
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0602
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2020-03/msg00008.html
vendor-advisory, mailing-list, third-party-advisory
-
security.gentoo.org
/glsa/202003-48
vendor-advisory, third-party-advisory
-
debian.org
/security/2020/dsa-4669
vendor-advisory, third-party-advisory
-
nodejs.org
/en/blog/release/v13.8.0/
vendor-advisory
-
nodejs.org
/en/blog/vulnerability/february-2020-security-releases/
vendor-advisory
-
nodejs.org
/en/blog/release/v10.19.0/
release-notes, vendor-advisory
-
nodejs.org
/en/blog/release/v12.15.0/
release-notes, vendor-advisory
-
oracle.com
/security-alerts/cpuapr2020.html
third-party-advisory
-
oracle.com
//security-alerts/cpujul2021.html
third-party-advisory
-
security.netapp.com
/advisory/ntap-20200221-0004/
third-party-advisory
Sources
- CVE List CVE-2019-15606
- NVD CVE-2019-15606
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.