Every CVE Search/ Get API key

CVE-2019-15605

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer...

9.8 CriticalPublic exploitFix available

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

57.1%Up 40.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Record
CVE-2019-15605
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-444
Updated
2026-11-02
CVE List No score

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Record
CVE-2019-15605
Weakness
CWE-444
Updated
2026-11-02
EUVDEUVD-2019-6565 No score

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Record
EUVD-2019-6565
Updated
2026-11-02
GitHub AdvisoriesGHSA-rv6p-2q56-m955 9.8

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer...

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Record
GHSA-rv6p-2q56-m955
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-444
Updated
2026-11-02
OSVALPINE-CVE-2019-15605 9.8

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Record
ALPINE-CVE-2019-15605
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVBELL-CVE-2019-15605 9.8

CVE-2019-15605 does not affect BellSoft software

Record
BELL-CVE-2019-15605
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 25 moreShow less
OSV 9.8

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Record
CVE-2019-15605
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-15605 9.8

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Record
DEBIAN-CVE-2019-15605
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:0573 7.1

Red Hat Security Advisory: nodejs:10 security update

Record
RHSA-2020:0573
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRHSA-2020:0579 7.1

Red Hat Security Advisory: nodejs:10 security update

Record
RHSA-2020:0579
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRHSA-2020:0597 7.1

Red Hat Security Advisory: rh-nodejs10-nodejs security update

Record
RHSA-2020:0597
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRHSA-2020:0598 7.1

Red Hat Security Advisory: nodejs:12 security update

Record
RHSA-2020:0598
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRHSA-2020:0602 7.1

Red Hat Security Advisory: rh-nodejs12-nodejs security update

Record
RHSA-2020:0602
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRHSA-2020:0703 7.1

Red Hat Security Advisory: http-parser security update

Record
RHSA-2020:0703
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRHSA-2020:0707 7.1

Red Hat Security Advisory: http-parser security update

Record
RHSA-2020:0707
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRHSA-2020:0708 7.1

Red Hat Security Advisory: http-parser security update

Record
RHSA-2020:0708
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRHSA-2020:1510 7.1

Red Hat Security Advisory: http-parser security update

Record
RHSA-2020:1510
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRLSA-2020:0579 7.1

Important: nodejs:10 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.19.0).

Security Fix(es):

  • nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

  • nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

  • nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

  • npm: Symlink reference outside of node_modules folder through the bin field upon installation (CVE-2019-16775)

  • npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

  • npm: Global node_modules Binary Overwrite (CVE-2019-16777)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2020:0579
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRLSA-2020:0598 7.1

Important: nodejs:12 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.16.1).

Security Fix(es):

  • nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

  • nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

  • nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2020:0598
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2019-15605 9.8

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Record
UBUNTU-CVE-2019-15605
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2020:0579 No score

Important: nodejs:10 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.19.0).

Security Fix(es):

  • nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

  • nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

  • nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

  • npm: Symlink reference outside of node_modules folder through the bin field upon installation (CVE-2019-16775)

  • npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

  • npm: Global node_modules Binary Overwrite (CVE-2019-16777)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2020:0579
Updated
2026-11-02
OSVALSA-2020:0598 No score

Important: nodejs:12 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.16.1).

Security Fix(es):

  • nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

  • nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

  • nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2020:0598
Updated
2026-11-02
OSVMGASA-2020-0131 No score

Updated http-parser packages fix security vulnerability

http-parser has been updated to fix a security issue.

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed (VE-2019-15605).

Record
MGASA-2020-0131
Updated
2026-11-02
OSVMGASA-2020-0372 No score

Updated nodejs packages fix security vulnerabilities

The nodejs package has been updated to the latest version in the 10.x branch, which is 10.22.1 at this time. It fixes several security issues and other bugs. See the upstream changelog and advisories for details.

Record
MGASA-2020-0372
Updated
2026-11-02
OSVopenSUSE-SU-2020:0293-1 No score

Security update for nodejs8

This update for nodejs8 fixes the following issues:

Security issues fixed:

  • CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).
  • CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).
  • CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:0293-1
Updated
2026-11-02
OSVSUSE-SU-2020:0427-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

nodejs10 was updated to version 10.19.0.

Security issues fixed:

  • CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).
  • CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).
  • CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).
Record
SUSE-SU-2020:0427-1
Updated
2026-11-02
OSVSUSE-SU-2020:0429-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

nodejs12 was updated to version 12.15.0.

Security issues fixed:

  • CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).
  • CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).
  • CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).
  • CVE-2019-16775: Fixed an arbitrary file write vulnerability (bsc#1159352).
  • CVE-2019-16776: Fixed an arbitrary file write vulnerability (bsc#1159352).
  • CVE-2019-16777: Fixed an arbitrary file write vulnerability (bsc#1159352).
Record
SUSE-SU-2020:0429-1
Updated
2026-11-02
OSVSUSE-SU-2020:0454-1 No score

Security update for nodejs8

This update for nodejs8 fixes the following issues:

Security issues fixed:

  • CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).
  • CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).
  • CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).
Record
SUSE-SU-2020:0454-1
Updated
2026-11-02
OSVSUSE-SU-2020:0455-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

nodejs10 was updated to version 10.19.0.

Security issues fixed:

  • CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).
  • CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).
  • CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).
Record
SUSE-SU-2020:0455-1
Updated
2026-11-02
OSVSUSE-SU-2020:0488-1 No score

Security update for nodejs6

This update for nodejs6 fixes the following issues:

Security issues fixed:

  • CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).
  • CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).
  • CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).
Record
SUSE-SU-2020:0488-1
Updated
2026-11-02
OSVUSN-6380-1 No score

nodejs vulnerabilities

Rogier Schouten discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-15604)

Ethan Rubinson discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-15605)

Alyssa Wilk discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-15606)

Tobias Niessen discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-8174)

It was discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2020-8265, CVE-2020-8287)

Record
USN-6380-1
Updated
2026-11-02

Affected products

Show 2 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
nodejs
Alpine:v3.10
 before 10.19.0-r0
10.19.0-r0
nodejs
Alpine:v3.11
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.12
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.13
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.14
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.15
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.16
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.17
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.18
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.19
 before 12.15.0-r0
12.15.0-r0
Show 128 moreShow less
Affected packages
PackageAffectedFixed
nodejs
Alpine:v3.20
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.21
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.22
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.23
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.24
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.9
 before 10.19.0-r0
10.19.0-r0
nodejs-current
Alpine:v3.12
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.13
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.14
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.15
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.16
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.17
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.18
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.19
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.20
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.21
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.22
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.23
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.24
 before 13.11.0-r0
13.11.0-r0
nodejs-nodemon
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1.18.3-1.module_el8.3.0+2023+d2377ea3
1.18.3-1.module_el8.3.0+2023+d2377ea3
nodejs-nodemon
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1.18.3-1.module_el8.3.0+2047+b07ac28e
1.18.3-1.module_el8.3.0+2047+b07ac28e
nodejs-packaging
AlmaLinux:8
From an advisory covering 6 CVEs
 before 17-3.module_el8.4.0+2224+b07ac28e
17-3.module_el8.4.0+2224+b07ac28e
nodejs-packaging
AlmaLinux:8
From an advisory covering 6 CVEs
 before 17-3.module_el8.4.0+2521+c668cc9f
17-3.module_el8.4.0+2521+c668cc9f
nodejs-packaging
AlmaLinux:8
From an advisory covering 6 CVEs
 before 17-3.module_el8.3.0+2023+d2377ea3
17-3.module_el8.3.0+2023+d2377ea3
nodejs-nodemon
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.18.3-1.module_el8.3.0+2023+d2377ea3
1.18.3-1.module_el8.3.0+2023+d2377ea3
nodejs-nodemon
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1.18.3-1.module_el8.3.0+2047+b07ac28e
1.18.3-1.module_el8.3.0+2047+b07ac28e
nodejs-packaging
AlmaLinux:8
From an advisory covering 3 CVEs
 before 17-3.module_el8.4.0+2224+b07ac28e
17-3.module_el8.4.0+2224+b07ac28e
nodejs-packaging
AlmaLinux:8
From an advisory covering 3 CVEs
 before 17-3.module_el8.4.0+2521+c668cc9f
17-3.module_el8.4.0+2521+c668cc9f
nodejs-packaging
AlmaLinux:8
From an advisory covering 3 CVEs
 before 17-3.module_el8.3.0+2023+d2377ea3
17-3.module_el8.3.0+2023+d2377ea3
http-parser
Debian:12
 before 2.9.4-2
2.9.4-2
http-parser
Debian:13
 before 2.9.4-2
2.9.4-2
http-parser
Debian:14
 before 2.9.4-2
2.9.4-2
nodejs
Debian:12
 before 10.19.0~dfsg-1
10.19.0~dfsg-1
nodejs
Debian:13
 before 10.19.0~dfsg-1
10.19.0~dfsg-1
nodejs
Debian:14
 before 10.19.0~dfsg-1
10.19.0~dfsg-1
nodejs
Debian:10
From an advisory covering 6 CVEs
 before 10.19.0~dfsg1-1, plus listed versions
10.15.2~dfsg-210.15.3~dfsg-110.16.3~dfsg-110.17.0~dfsg-110.17.0~dfsg-210.19.0~dfsg-110.19.0~dfsg-210.19.0~dfsg-3
10.19.0~dfsg1-1
http-parser
Mageia:7
 before 2.9.3-1.mga7
2.9.3-1.mga7
libuv
Mageia:7
From an advisory covering 16 CVEs
 before 1.34.2-1.mga7
1.34.2-1.mga7
nodejs
Mageia:7
From an advisory covering 16 CVEs
 before 10.22.1-9.mga7
10.22.1-9.mga7
nodejs
Red Hat:rhel_e4s:8.0::appstream
From an advisory covering 6 CVEs
 before 1:10.19.0-1.module+el8.0.0+5738+1362a79c
1:10.19.0-1.module+el8.0.0+5738+1362a79c
nodejs-debuginfo
Red Hat:rhel_e4s:8.0::appstream
From an advisory covering 6 CVEs
 before 1:10.19.0-1.module+el8.0.0+5738+1362a79c
1:10.19.0-1.module+el8.0.0+5738+1362a79c
nodejs-debugsource
Red Hat:rhel_e4s:8.0::appstream
From an advisory covering 6 CVEs
 before 1:10.19.0-1.module+el8.0.0+5738+1362a79c
1:10.19.0-1.module+el8.0.0+5738+1362a79c
nodejs-devel
Red Hat:rhel_e4s:8.0::appstream
From an advisory covering 6 CVEs
 before 1:10.19.0-1.module+el8.0.0+5738+1362a79c
1:10.19.0-1.module+el8.0.0+5738+1362a79c
nodejs-devel-debuginfo
Red Hat:rhel_e4s:8.0::appstream
From an advisory covering 6 CVEs
 before 1:10.19.0-1.module+el8.0.0+5738+1362a79c
1:10.19.0-1.module+el8.0.0+5738+1362a79c
nodejs-docs
Red Hat:rhel_e4s:8.0::appstream
From an advisory covering 6 CVEs
 before 1:10.19.0-1.module+el8.0.0+5738+1362a79c
1:10.19.0-1.module+el8.0.0+5738+1362a79c
nodejs-nodemon
Red Hat:rhel_e4s:8.0::appstream
From an advisory covering 6 CVEs
 before 0:1.18.3-1.module+el8+2632+6c5111ed
0:1.18.3-1.module+el8+2632+6c5111ed
nodejs-packaging
Red Hat:rhel_e4s:8.0::appstream
From an advisory covering 6 CVEs
 before 0:17-3.module+el8+2873+aa7dfd9a
0:17-3.module+el8+2873+aa7dfd9a
npm
Red Hat:rhel_e4s:8.0::appstream
From an advisory covering 6 CVEs
 before 1:6.13.4-1.10.19.0.1.module+el8.0.0+5738+1362a79c
1:6.13.4-1.10.19.0.1.module+el8.0.0+5738+1362a79c
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
nodejs-devel-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:1.18.3-1.module+el8+2632+6c5111ed
0:1.18.3-1.module+el8+2632+6c5111ed
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:17-3.module+el8+2873+aa7dfd9a
0:17-3.module+el8+2873+aa7dfd9a
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c
1:6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c
rh-nodejs10-nodejs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 6 CVEs
 before 0:10.19.0-1.el7
0:10.19.0-1.el7
rh-nodejs10-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 6 CVEs
 before 0:10.19.0-1.el7
0:10.19.0-1.el7
rh-nodejs10-nodejs-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 6 CVEs
 before 0:10.19.0-1.el7
0:10.19.0-1.el7
rh-nodejs10-nodejs-docs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 6 CVEs
 before 0:10.19.0-1.el7
0:10.19.0-1.el7
rh-nodejs10-npm
Red Hat:rhel_software_collections:3::el7
From an advisory covering 6 CVEs
 before 0:6.13.4-10.19.0.1.el7
0:6.13.4-10.19.0.1.el7
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:12.16.1-1.module+el8.1.0+5811+44509afe
1:12.16.1-1.module+el8.1.0+5811+44509afe
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:12.16.1-1.module+el8.1.0+5811+44509afe
1:12.16.1-1.module+el8.1.0+5811+44509afe
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:12.16.1-1.module+el8.1.0+5811+44509afe
1:12.16.1-1.module+el8.1.0+5811+44509afe
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:12.16.1-1.module+el8.1.0+5811+44509afe
1:12.16.1-1.module+el8.1.0+5811+44509afe
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:12.16.1-1.module+el8.1.0+5811+44509afe
1:12.16.1-1.module+el8.1.0+5811+44509afe
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
0:1.18.3-1.module+el8.1.0+3369+37ae6a45
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:6.13.4-1.12.16.1.1.module+el8.1.0+5811+44509afe
1:6.13.4-1.12.16.1.1.module+el8.1.0+5811+44509afe
rh-nodejs12-nodejs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 6 CVEs
 before 0:12.16.1-1.el7
0:12.16.1-1.el7
rh-nodejs12-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 6 CVEs
 before 0:12.16.1-1.el7
0:12.16.1-1.el7
rh-nodejs12-nodejs-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 6 CVEs
 before 0:12.16.1-1.el7
0:12.16.1-1.el7
rh-nodejs12-nodejs-docs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 6 CVEs
 before 0:12.16.1-1.el7
0:12.16.1-1.el7
rh-nodejs12-npm
Red Hat:rhel_software_collections:3::el7
From an advisory covering 6 CVEs
 before 0:6.13.4-12.16.1.1.el7
0:6.13.4-12.16.1.1.el7
http-parser
Red Hat:enterprise_linux:7::client
 before 0:2.7.1-8.el7_7.2
0:2.7.1-8.el7_7.2
http-parser-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:2.7.1-8.el7_7.2
0:2.7.1-8.el7_7.2
http-parser-devel
Red Hat:enterprise_linux:7::client
 before 0:2.7.1-8.el7_7.2
0:2.7.1-8.el7_7.2
http-parser
Red Hat:enterprise_linux:7::computenode
 before 0:2.7.1-8.el7_7.2
0:2.7.1-8.el7_7.2
http-parser-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:2.7.1-8.el7_7.2
0:2.7.1-8.el7_7.2
http-parser-devel
Red Hat:enterprise_linux:7::computenode
 before 0:2.7.1-8.el7_7.2
0:2.7.1-8.el7_7.2
http-parser
Red Hat:enterprise_linux:7::server
 before 0:2.7.1-8.el7_7.2
0:2.7.1-8.el7_7.2
http-parser-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:2.7.1-8.el7_7.2
0:2.7.1-8.el7_7.2
http-parser-devel
Red Hat:enterprise_linux:7::server
 before 0:2.7.1-8.el7_7.2
0:2.7.1-8.el7_7.2
http-parser
Red Hat:enterprise_linux:7::workstation
 before 0:2.7.1-8.el7_7.2
0:2.7.1-8.el7_7.2
http-parser-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:2.7.1-8.el7_7.2
0:2.7.1-8.el7_7.2
http-parser-devel
Red Hat:enterprise_linux:7::workstation
 before 0:2.7.1-8.el7_7.2
0:2.7.1-8.el7_7.2
http-parser
Red Hat:rhel_e4s:8.0::appstream
 before 0:2.8.0-2.el8_0.2
0:2.8.0-2.el8_0.2
http-parser-debuginfo
Red Hat:rhel_e4s:8.0::appstream
 before 0:2.8.0-2.el8_0.2
0:2.8.0-2.el8_0.2
http-parser-debugsource
Red Hat:rhel_e4s:8.0::appstream
 before 0:2.8.0-2.el8_0.2
0:2.8.0-2.el8_0.2
http-parser
Red Hat:enterprise_linux:8::appstream
 before 0:2.8.0-5.el8_1.2
0:2.8.0-5.el8_1.2
http-parser-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.8.0-5.el8_1.2
0:2.8.0-5.el8_1.2
http-parser-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:2.8.0-5.el8_1.2
0:2.8.0-5.el8_1.2
http-parser
Red Hat:rhel_eus:7.6::computenode
 before 0:2.7.1-5.el7_6.1
0:2.7.1-5.el7_6.1
http-parser-debuginfo
Red Hat:rhel_eus:7.6::computenode
 before 0:2.7.1-5.el7_6.1
0:2.7.1-5.el7_6.1
http-parser-devel
Red Hat:rhel_eus:7.6::computenode
 before 0:2.7.1-5.el7_6.1
0:2.7.1-5.el7_6.1
http-parser
Red Hat:rhel_eus:7.6::server
 before 0:2.7.1-5.el7_6.1
0:2.7.1-5.el7_6.1
http-parser-debuginfo
Red Hat:rhel_eus:7.6::server
 before 0:2.7.1-5.el7_6.1
0:2.7.1-5.el7_6.1
http-parser-devel
Red Hat:rhel_eus:7.6::server
 before 0:2.7.1-5.el7_6.1
0:2.7.1-5.el7_6.1
nodejs-nodemon
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:1.18.3-1.module+el8.3.0+101+f84c7154
0:1.18.3-1.module+el8.3.0+101+f84c7154
nodejs-packaging
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:17-3.module+el8.3.0+101+f84c7154
0:17-3.module+el8.3.0+101+f84c7154
nodejs-nodemon
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:1.18.3-1.module+el8.3.0+101+f84c7154
0:1.18.3-1.module+el8.3.0+101+f84c7154
nodejs-packaging
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:17-3.module+el8.3.0+101+f84c7154
0:17-3.module+el8.3.0+101+f84c7154
nodejs10
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 3 CVEs
 before 10.19.0-1.18.1
10.19.0-1.18.1
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 6 CVEs
 before 12.15.0-1.6.1
12.15.0-1.6.1
nodejs8
SUSE:Linux Enterprise Module for Web and Scripting 15
From an advisory covering 3 CVEs
 before 8.17.0-3.28.1
8.17.0-3.28.1
nodejs8
SUSE:Linux Enterprise Module for Web and Scripting 15 SP1
From an advisory covering 3 CVEs
 before 8.17.0-3.28.1
8.17.0-3.28.1
nodejs8
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 3 CVEs
 before 8.17.0-3.28.1
8.17.0-3.28.1
nodejs8
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 3 CVEs
 before 8.17.0-3.28.1
8.17.0-3.28.1
nodejs8
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 3 CVEs
 before 8.17.0-3.28.1
8.17.0-3.28.1
nodejs8
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 3 CVEs
 before 8.17.0-3.28.1
8.17.0-3.28.1
nodejs10
SUSE:Linux Enterprise Module for Web and Scripting 15
From an advisory covering 3 CVEs
 before 10.19.0-1.18.1
10.19.0-1.18.1
nodejs10
SUSE:Linux Enterprise Module for Web and Scripting 15 SP1
From an advisory covering 3 CVEs
 before 10.19.0-1.18.1
10.19.0-1.18.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 3 CVEs
 before 10.19.0-1.18.1
10.19.0-1.18.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 3 CVEs
 before 10.19.0-1.18.1
10.19.0-1.18.1
nodejs10
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 3 CVEs
 before 10.19.0-1.18.1
10.19.0-1.18.1
nodejs10
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 3 CVEs
 before 10.19.0-1.18.1
10.19.0-1.18.1
nodejs6
SUSE:OpenStack Cloud 7
From an advisory covering 3 CVEs
 before 6.17.1-11.33.1
6.17.1-11.33.1
nodejs6
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 3 CVEs
 before 6.17.1-11.33.1
6.17.1-11.33.1
nodejs6
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 3 CVEs
 before 6.17.1-11.33.1
6.17.1-11.33.1
nodejs6
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 3 CVEs
 before 6.17.1-11.33.1
6.17.1-11.33.1
nodejs
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.10.15~dfsg1-40.10.21~dfsg1-10.10.22~dfsg1-20.10.23~dfsg1-10.10.23~dfsg1-2
Show 7 moreShow less
0.10.23~dfsg1-30.10.24~dfsg1-10.10.25~dfsg2-20.10.25~dfsg2-2ubuntu10.10.25~dfsg2-2ubuntu1.20.10.25~dfsg2-2ubuntu1.2+esm10.10.25~dfsg2-2ubuntu1.2+esm2
 None known
nodejs
Ubuntu:Pro:16.04:LTS
 before 4.2.6~dfsg-1ubuntu4.2+esm2, plus listed versions
0.10.25~dfsg2-2ubuntu14.2.2~dfsg-14.2.3~dfsg-14.2.4~dfsg-1ubuntu14.2.4~dfsg-2
Show 5 moreShow less
4.2.6~dfsg-1ubuntu14.2.6~dfsg-1ubuntu44.2.6~dfsg-1ubuntu4.14.2.6~dfsg-1ubuntu4.24.2.6~dfsg-1ubuntu4.2+esm1
4.2.6~dfsg-1ubuntu4.2+esm2
nodejs
Ubuntu:Pro:18.04:LTS
 before 8.10.0~dfsg-2ubuntu0.4+esm2, plus listed versions
6.11.4~dfsg-1ubuntu16.11.4~dfsg-1ubuntu26.12.0~dfsg-1ubuntu16.12.0~dfsg-2ubuntu16.12.0~dfsg-2ubuntu2
Show 5 moreShow less
8.10.0~dfsg-28.10.0~dfsg-2ubuntu0.28.10.0~dfsg-2ubuntu0.38.10.0~dfsg-2ubuntu0.48.10.0~dfsg-2ubuntu0.4+esm1
8.10.0~dfsg-2ubuntu0.4+esm2
nodejs
Ubuntu:Pro:16.04:LTS
From an advisory covering 6 CVEs
 before 4.2.6~dfsg-1ubuntu4.2+esm2, plus listed versions
0.10.25~dfsg2-2ubuntu14.2.2~dfsg-14.2.3~dfsg-14.2.4~dfsg-1ubuntu14.2.4~dfsg-2
Show 5 moreShow less
4.2.6~dfsg-1ubuntu14.2.6~dfsg-1ubuntu44.2.6~dfsg-1ubuntu4.14.2.6~dfsg-1ubuntu4.24.2.6~dfsg-1ubuntu4.2+esm1
4.2.6~dfsg-1ubuntu4.2+esm2
nodejs
Ubuntu:Pro:18.04:LTS
From an advisory covering 6 CVEs
 before 8.10.0~dfsg-2ubuntu0.4+esm2, plus listed versions
6.11.4~dfsg-1ubuntu16.11.4~dfsg-1ubuntu26.12.0~dfsg-1ubuntu16.12.0~dfsg-2ubuntu16.12.0~dfsg-2ubuntu2
Show 5 moreShow less
8.10.0~dfsg-28.10.0~dfsg-2ubuntu0.28.10.0~dfsg-2ubuntu0.38.10.0~dfsg-2ubuntu0.48.10.0~dfsg-2ubuntu0.4+esm1
8.10.0~dfsg-2ubuntu0.4+esm2
nodejs
Ubuntu:20.04:LTS
From an advisory covering 6 CVEs
 before 10.19.0~dfsg-3ubuntu1.1, plus listed versions
10.15.2~dfsg-2ubuntu110.17.0~dfsg-2ubuntu410.17.0~dfsg-2ubuntu610.19.0~dfsg-3ubuntu1
10.19.0~dfsg-3ubuntu1.1
nodejs8
openSUSE:Leap 15.1
From an advisory covering 3 CVEs
 before 8.17.0-lp151.2.12.1
8.17.0-lp151.2.12.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHub0-9194/node-poc-http-smuggling2020-05-04

History

History
RecordedChangedSources
affected, facts
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-15605 is a critical vulnerability (CVSS 9.8) in Nodejs Node, published February 7, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 57.1%, the 99th percentile. Fixed in nodejs 10.19.0-r0.

References

Show 99 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open