Every CVE Search/ Get API key

CVE-2019-15606

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of...

9.8 CriticalFix available

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

20.0%Up 16.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

Record
CVE-2019-15606
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

Record
CVE-2019-15606
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2019-6566 No score

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

Record
EUVD-2019-6566
Updated
2026-11-02
GitHub AdvisoriesGHSA-3qv8-368w-r69p 9.8

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of...

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

Record
GHSA-3qv8-368w-r69p
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSVALPINE-CVE-2019-15606 9.8

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

Record
ALPINE-CVE-2019-15606
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVBELL-CVE-2019-15606 9.8

CVE-2019-15606 does not affect BellSoft software

Record
BELL-CVE-2019-15606
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 20 moreShow less
OSV 9.8

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

Record
CVE-2019-15606
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-15606 9.8

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

Record
DEBIAN-CVE-2019-15606
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:0573 7.1

Red Hat Security Advisory: nodejs:10 security update

Record
RHSA-2020:0573
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRHSA-2020:0579 7.1

Red Hat Security Advisory: nodejs:10 security update

Record
RHSA-2020:0579
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRHSA-2020:0597 7.1

Red Hat Security Advisory: rh-nodejs10-nodejs security update

Record
RHSA-2020:0597
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRHSA-2020:0598 7.1

Red Hat Security Advisory: nodejs:12 security update

Record
RHSA-2020:0598
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRHSA-2020:0602 7.1

Red Hat Security Advisory: rh-nodejs12-nodejs security update

Record
RHSA-2020:0602
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRLSA-2020:0579 7.1

Important: nodejs:10 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.19.0).

Security Fix(es):

  • nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

  • nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

  • nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

  • npm: Symlink reference outside of node_modules folder through the bin field upon installation (CVE-2019-16775)

  • npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

  • npm: Global node_modules Binary Overwrite (CVE-2019-16777)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2020:0579
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRLSA-2020:0598 7.1

Important: nodejs:12 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.16.1).

Security Fix(es):

  • nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

  • nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

  • nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2020:0598
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2019-15606 9.8

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

Record
UBUNTU-CVE-2019-15606
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2020:0579 No score

Important: nodejs:10 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.19.0).

Security Fix(es):

  • nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

  • nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

  • nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

  • npm: Symlink reference outside of node_modules folder through the bin field upon installation (CVE-2019-16775)

  • npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

  • npm: Global node_modules Binary Overwrite (CVE-2019-16777)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2020:0579
Updated
2026-11-02
OSVALSA-2020:0598 No score

Important: nodejs:12 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.16.1).

Security Fix(es):

  • nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

  • nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

  • nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2020:0598
Updated
2026-11-02
OSVMGASA-2020-0372 No score

Updated nodejs packages fix security vulnerabilities

The nodejs package has been updated to the latest version in the 10.x branch, which is 10.22.1 at this time. It fixes several security issues and other bugs. See the upstream changelog and advisories for details.

Record
MGASA-2020-0372
Updated
2026-11-02
OSVopenSUSE-SU-2020:0293-1 No score

Security update for nodejs8

This update for nodejs8 fixes the following issues:

Security issues fixed:

  • CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).
  • CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).
  • CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:0293-1
Updated
2026-11-02
OSVSUSE-SU-2020:0427-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

nodejs10 was updated to version 10.19.0.

Security issues fixed:

  • CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).
  • CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).
  • CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).
Record
SUSE-SU-2020:0427-1
Updated
2026-11-02
OSVSUSE-SU-2020:0429-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

nodejs12 was updated to version 12.15.0.

Security issues fixed:

  • CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).
  • CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).
  • CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).
  • CVE-2019-16775: Fixed an arbitrary file write vulnerability (bsc#1159352).
  • CVE-2019-16776: Fixed an arbitrary file write vulnerability (bsc#1159352).
  • CVE-2019-16777: Fixed an arbitrary file write vulnerability (bsc#1159352).
Record
SUSE-SU-2020:0429-1
Updated
2026-11-02
OSVSUSE-SU-2020:0454-1 No score

Security update for nodejs8

This update for nodejs8 fixes the following issues:

Security issues fixed:

  • CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).
  • CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).
  • CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).
Record
SUSE-SU-2020:0454-1
Updated
2026-11-02
OSVSUSE-SU-2020:0455-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

nodejs10 was updated to version 10.19.0.

Security issues fixed:

  • CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).
  • CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).
  • CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).
Record
SUSE-SU-2020:0455-1
Updated
2026-11-02
OSVSUSE-SU-2020:0488-1 No score

Security update for nodejs6

This update for nodejs6 fixes the following issues:

Security issues fixed:

  • CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).
  • CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).
  • CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).
Record
SUSE-SU-2020:0488-1
Updated
2026-11-02
OSVUSN-6380-1 No score

nodejs vulnerabilities

Rogier Schouten discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-15604)

Ethan Rubinson discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-15605)

Alyssa Wilk discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-15606)

Tobias Niessen discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-8174)

It was discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2020-8265, CVE-2020-8287)

Record
USN-6380-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nodejs
Alpine:v3.10
 before 10.19.0-r0
10.19.0-r0
nodejs
Alpine:v3.11
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.12
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.13
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.14
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.15
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.16
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.17
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.18
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.19
 before 12.15.0-r0
12.15.0-r0
Show 91 moreShow less
Affected packages
PackageAffectedFixed
nodejs
Alpine:v3.20
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.21
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.22
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.23
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.24
 before 12.15.0-r0
12.15.0-r0
nodejs
Alpine:v3.9
 before 10.19.0-r0
10.19.0-r0
nodejs-current
Alpine:v3.12
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.13
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.14
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.15
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.16
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.17
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.18
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.19
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.20
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.21
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.22
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.23
 before 13.11.0-r0
13.11.0-r0
nodejs-current
Alpine:v3.24
 before 13.11.0-r0
13.11.0-r0
nodejs-nodemon
AlmaLinux:8
 before 1.18.3-1.module_el8.3.0+2023+d2377ea3
1.18.3-1.module_el8.3.0+2023+d2377ea3
nodejs-nodemon
AlmaLinux:8
 before 1.18.3-1.module_el8.3.0+2047+b07ac28e
1.18.3-1.module_el8.3.0+2047+b07ac28e
nodejs-packaging
AlmaLinux:8
 before 17-3.module_el8.4.0+2224+b07ac28e
17-3.module_el8.4.0+2224+b07ac28e
nodejs-packaging
AlmaLinux:8
 before 17-3.module_el8.4.0+2521+c668cc9f
17-3.module_el8.4.0+2521+c668cc9f
nodejs-packaging
AlmaLinux:8
 before 17-3.module_el8.3.0+2023+d2377ea3
17-3.module_el8.3.0+2023+d2377ea3
nodejs
Debian:12
 before 10.19.0~dfsg-1
10.19.0~dfsg-1
nodejs
Debian:13
 before 10.19.0~dfsg-1
10.19.0~dfsg-1
nodejs
Debian:14
 before 10.19.0~dfsg-1
10.19.0~dfsg-1
nodejs
Debian:10
 before 10.19.0~dfsg1-1, plus listed versions
10.15.2~dfsg-210.15.3~dfsg-110.16.3~dfsg-110.17.0~dfsg-110.17.0~dfsg-210.19.0~dfsg-110.19.0~dfsg-210.19.0~dfsg-3
10.19.0~dfsg1-1
libuv
Mageia:7
 before 1.34.2-1.mga7
1.34.2-1.mga7
nodejs
Mageia:7
 before 10.22.1-9.mga7
10.22.1-9.mga7
nodejs
Red Hat:rhel_e4s:8.0::appstream
 before 1:10.19.0-1.module+el8.0.0+5738+1362a79c
1:10.19.0-1.module+el8.0.0+5738+1362a79c
nodejs-debuginfo
Red Hat:rhel_e4s:8.0::appstream
 before 1:10.19.0-1.module+el8.0.0+5738+1362a79c
1:10.19.0-1.module+el8.0.0+5738+1362a79c
nodejs-debugsource
Red Hat:rhel_e4s:8.0::appstream
 before 1:10.19.0-1.module+el8.0.0+5738+1362a79c
1:10.19.0-1.module+el8.0.0+5738+1362a79c
nodejs-devel
Red Hat:rhel_e4s:8.0::appstream
 before 1:10.19.0-1.module+el8.0.0+5738+1362a79c
1:10.19.0-1.module+el8.0.0+5738+1362a79c
nodejs-devel-debuginfo
Red Hat:rhel_e4s:8.0::appstream
 before 1:10.19.0-1.module+el8.0.0+5738+1362a79c
1:10.19.0-1.module+el8.0.0+5738+1362a79c
nodejs-docs
Red Hat:rhel_e4s:8.0::appstream
 before 1:10.19.0-1.module+el8.0.0+5738+1362a79c
1:10.19.0-1.module+el8.0.0+5738+1362a79c
nodejs-nodemon
Red Hat:rhel_e4s:8.0::appstream
 before 0:1.18.3-1.module+el8+2632+6c5111ed
0:1.18.3-1.module+el8+2632+6c5111ed
nodejs-packaging
Red Hat:rhel_e4s:8.0::appstream
 before 0:17-3.module+el8+2873+aa7dfd9a
0:17-3.module+el8+2873+aa7dfd9a
npm
Red Hat:rhel_e4s:8.0::appstream
 before 1:6.13.4-1.10.19.0.1.module+el8.0.0+5738+1362a79c
1:6.13.4-1.10.19.0.1.module+el8.0.0+5738+1362a79c
nodejs
Red Hat:enterprise_linux:8::appstream
 before 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
nodejs-devel
Red Hat:enterprise_linux:8::appstream
 before 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
nodejs-devel-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
nodejs-docs
Red Hat:enterprise_linux:8::appstream
 before 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
 before 0:1.18.3-1.module+el8+2632+6c5111ed
0:1.18.3-1.module+el8+2632+6c5111ed
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
 before 0:17-3.module+el8+2873+aa7dfd9a
0:17-3.module+el8+2873+aa7dfd9a
npm
Red Hat:enterprise_linux:8::appstream
 before 1:6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c
1:6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c
rh-nodejs10-nodejs
Red Hat:rhel_software_collections:3::el7
 before 0:10.19.0-1.el7
0:10.19.0-1.el7
rh-nodejs10-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
 before 0:10.19.0-1.el7
0:10.19.0-1.el7
rh-nodejs10-nodejs-devel
Red Hat:rhel_software_collections:3::el7
 before 0:10.19.0-1.el7
0:10.19.0-1.el7
rh-nodejs10-nodejs-docs
Red Hat:rhel_software_collections:3::el7
 before 0:10.19.0-1.el7
0:10.19.0-1.el7
rh-nodejs10-npm
Red Hat:rhel_software_collections:3::el7
 before 0:6.13.4-10.19.0.1.el7
0:6.13.4-10.19.0.1.el7
nodejs
Red Hat:enterprise_linux:8::appstream
 before 1:12.16.1-1.module+el8.1.0+5811+44509afe
1:12.16.1-1.module+el8.1.0+5811+44509afe
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:12.16.1-1.module+el8.1.0+5811+44509afe
1:12.16.1-1.module+el8.1.0+5811+44509afe
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:12.16.1-1.module+el8.1.0+5811+44509afe
1:12.16.1-1.module+el8.1.0+5811+44509afe
nodejs-devel
Red Hat:enterprise_linux:8::appstream
 before 1:12.16.1-1.module+el8.1.0+5811+44509afe
1:12.16.1-1.module+el8.1.0+5811+44509afe
nodejs-docs
Red Hat:enterprise_linux:8::appstream
 before 1:12.16.1-1.module+el8.1.0+5811+44509afe
1:12.16.1-1.module+el8.1.0+5811+44509afe
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
 before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
0:1.18.3-1.module+el8.1.0+3369+37ae6a45
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:enterprise_linux:8::appstream
 before 1:6.13.4-1.12.16.1.1.module+el8.1.0+5811+44509afe
1:6.13.4-1.12.16.1.1.module+el8.1.0+5811+44509afe
rh-nodejs12-nodejs
Red Hat:rhel_software_collections:3::el7
 before 0:12.16.1-1.el7
0:12.16.1-1.el7
rh-nodejs12-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
 before 0:12.16.1-1.el7
0:12.16.1-1.el7
rh-nodejs12-nodejs-devel
Red Hat:rhel_software_collections:3::el7
 before 0:12.16.1-1.el7
0:12.16.1-1.el7
rh-nodejs12-nodejs-docs
Red Hat:rhel_software_collections:3::el7
 before 0:12.16.1-1.el7
0:12.16.1-1.el7
rh-nodejs12-npm
Red Hat:rhel_software_collections:3::el7
 before 0:6.13.4-12.16.1.1.el7
0:6.13.4-12.16.1.1.el7
nodejs-nodemon
Rocky Linux:8
 before 0:1.18.3-1.module+el8.3.0+101+f84c7154
0:1.18.3-1.module+el8.3.0+101+f84c7154
nodejs-packaging
Rocky Linux:8
 before 0:17-3.module+el8.3.0+101+f84c7154
0:17-3.module+el8.3.0+101+f84c7154
nodejs10
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 10.19.0-1.18.1
10.19.0-1.18.1
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 12.15.0-1.6.1
12.15.0-1.6.1
nodejs8
SUSE:Linux Enterprise Module for Web and Scripting 15
 before 8.17.0-3.28.1
8.17.0-3.28.1
nodejs8
SUSE:Linux Enterprise Module for Web and Scripting 15 SP1
 before 8.17.0-3.28.1
8.17.0-3.28.1
nodejs8
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 8.17.0-3.28.1
8.17.0-3.28.1
nodejs8
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 8.17.0-3.28.1
8.17.0-3.28.1
nodejs8
SUSE:Linux Enterprise Server 15-LTSS
 before 8.17.0-3.28.1
8.17.0-3.28.1
nodejs8
SUSE:Linux Enterprise Server for SAP Applications 15
 before 8.17.0-3.28.1
8.17.0-3.28.1
nodejs10
SUSE:Linux Enterprise Module for Web and Scripting 15
 before 10.19.0-1.18.1
10.19.0-1.18.1
nodejs10
SUSE:Linux Enterprise Module for Web and Scripting 15 SP1
 before 10.19.0-1.18.1
10.19.0-1.18.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 10.19.0-1.18.1
10.19.0-1.18.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 10.19.0-1.18.1
10.19.0-1.18.1
nodejs10
SUSE:Linux Enterprise Server 15-LTSS
 before 10.19.0-1.18.1
10.19.0-1.18.1
nodejs10
SUSE:Linux Enterprise Server for SAP Applications 15
 before 10.19.0-1.18.1
10.19.0-1.18.1
nodejs6
SUSE:OpenStack Cloud 7
 before 6.17.1-11.33.1
6.17.1-11.33.1
nodejs6
SUSE:OpenStack Cloud Crowbar 8
 before 6.17.1-11.33.1
6.17.1-11.33.1
nodejs6
SUSE:OpenStack Cloud Crowbar 9
 before 6.17.1-11.33.1
6.17.1-11.33.1
nodejs6
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 6.17.1-11.33.1
6.17.1-11.33.1
nodejs
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.10.15~dfsg1-40.10.21~dfsg1-10.10.22~dfsg1-20.10.23~dfsg1-10.10.23~dfsg1-2
Show 7 moreShow less
0.10.23~dfsg1-30.10.24~dfsg1-10.10.25~dfsg2-20.10.25~dfsg2-2ubuntu10.10.25~dfsg2-2ubuntu1.20.10.25~dfsg2-2ubuntu1.2+esm10.10.25~dfsg2-2ubuntu1.2+esm2
 None known
nodejs
Ubuntu:Pro:16.04:LTS
 before 4.2.6~dfsg-1ubuntu4.2+esm2, plus listed versions
0.10.25~dfsg2-2ubuntu14.2.2~dfsg-14.2.3~dfsg-14.2.4~dfsg-1ubuntu14.2.4~dfsg-2
Show 5 moreShow less
4.2.6~dfsg-1ubuntu14.2.6~dfsg-1ubuntu44.2.6~dfsg-1ubuntu4.14.2.6~dfsg-1ubuntu4.24.2.6~dfsg-1ubuntu4.2+esm1
4.2.6~dfsg-1ubuntu4.2+esm2
nodejs
Ubuntu:Pro:18.04:LTS
 before 8.10.0~dfsg-2ubuntu0.4+esm2, plus listed versions
6.11.4~dfsg-1ubuntu16.11.4~dfsg-1ubuntu26.12.0~dfsg-1ubuntu16.12.0~dfsg-2ubuntu16.12.0~dfsg-2ubuntu2
Show 5 moreShow less
8.10.0~dfsg-28.10.0~dfsg-2ubuntu0.28.10.0~dfsg-2ubuntu0.38.10.0~dfsg-2ubuntu0.48.10.0~dfsg-2ubuntu0.4+esm1
8.10.0~dfsg-2ubuntu0.4+esm2
nodejs
Ubuntu:20.04:LTS
 before 10.19.0~dfsg-3ubuntu1.1, plus listed versions
10.15.2~dfsg-2ubuntu110.17.0~dfsg-2ubuntu410.17.0~dfsg-2ubuntu610.19.0~dfsg-3ubuntu1
10.19.0~dfsg-3ubuntu1.1
nodejs8
openSUSE:Leap 15.1
 before 8.17.0-lp151.2.12.1
8.17.0-lp151.2.12.1

History

History
RecordedChangedSources
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-15606 is a critical vulnerability (CVSS 9.8) in Nodejs Node, published February 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 20.0%, the 97th percentile. Fixed in nodejs 10.19.0-r0.

References

Show 85 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open