{"id":"CVE-2019-15604","aliases":["ALPINE-CVE-2019-15604","ALSA-2020:0579","ALSA-2020:0598","BELL-CVE-2019-15604","DEBIAN-CVE-2019-15604","DSA-4669-1","EUVD-2019-6564","GHSA-4p8g-wmmc-p9f7","MGASA-2020-0372","RHSA-2020:0573","RHSA-2020:0579","RHSA-2020:0597","RHSA-2020:0598","RHSA-2020:0602","RLSA-2020:0579","RLSA-2020:0598","SUSE-SU-2020:0427-1","SUSE-SU-2020:0429-1","SUSE-SU-2020:0454-1","SUSE-SU-2020:0455-1","SUSE-SU-2020:0488-1","UBUNTU-CVE-2019-15604","USN-6380-1","openSUSE-SU-2020:0293-1"],"status":"published","title":"Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when...","description":"Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.19966,"percentile":0.97453,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2020-02-07T14:57:07Z","modified":"2026-11-03T06:30:09Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"nodejs","fixed_in":["10.19.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"nodejs","fixed_in":["12.15.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"nodejs","fixed_in":["12.15.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"nodejs","fixed_in":["12.15.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nodejs","fixed_in":["12.15.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs","fixed_in":["12.15.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs","fixed_in":["12.15.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs","fixed_in":["12.15.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs","fixed_in":["12.15.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs","fixed_in":["12.15.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs","fixed_in":["12.15.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["12.15.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["12.15.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["12.15.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["12.15.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"nodejs","fixed_in":["10.19.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"nodejs-current","fixed_in":["13.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"nodejs-current","fixed_in":["13.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nodejs-current","fixed_in":["13.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs-current","fixed_in":["13.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs-current","fixed_in":["13.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs-current","fixed_in":["13.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs-current","fixed_in":["13.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs-current","fixed_in":["13.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs-current","fixed_in":["13.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs-current","fixed_in":["13.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs-current","fixed_in":["13.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs-current","fixed_in":["13.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs-current","fixed_in":["13.11.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nodejs","fixed_in":["10.19.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nodejs","fixed_in":["10.19.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["10.19.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","fixed_in":["4.2.6~dfsg-1ubuntu4.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","fixed_in":["8.10.0~dfsg-2ubuntu0.4+esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.19.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.15.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.15.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.15.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.15.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.15.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.15.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.15.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.15.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.15.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.15.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.15.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.15.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.15.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.15.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.19.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.11.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.19.0~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.19.0~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.19.0~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.19.0~dfsg1-1"}]}],"versions":["10.15.2~dfsg-2","10.15.3~dfsg-1","10.16.3~dfsg-1","10.17.0~dfsg-1","10.17.0~dfsg-2","10.19.0~dfsg-1","10.19.0~dfsg-2","10.19.0~dfsg-3"],"bundled":6},{"source":"osv","ecosystem":"Mageia:7","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.2-1.mga7"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:7","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.22.1-9.mga7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8+2632+6c5111ed"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8+2873+aa7dfd9a"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.13.4-1.10.19.0.1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8+2632+6c5111ed"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8+2873+aa7dfd9a"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.19.0-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.19.0-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.19.0-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.19.0-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.13.4-10.19.0.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.16.1-1.module+el8.1.0+5811+44509afe"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.16.1-1.module+el8.1.0+5811+44509afe"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.16.1-1.module+el8.1.0+5811+44509afe"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.16.1-1.module+el8.1.0+5811+44509afe"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.16.1-1.module+el8.1.0+5811+44509afe"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.13.4-1.12.16.1.1.module+el8.1.0+5811+44509afe"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.16.1-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.16.1-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.16.1-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.16.1-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.13.4-12.16.1.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.3.0+101+f84c7154"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.3.0+101+f84c7154"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.19.0-1.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.15.0-1.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.28.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.28.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.28.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.28.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.28.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.28.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.19.0-1.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.19.0-1.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.19.0-1.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.19.0-1.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.19.0-1.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.19.0-1.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.1-11.33.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.1-11.33.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.1-11.33.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.1-11.33.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6~dfsg-1ubuntu4.2+esm2"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2","4.2.6~dfsg-1ubuntu4.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10.0~dfsg-2ubuntu0.4+esm2"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4","8.10.0~dfsg-2ubuntu0.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6~dfsg-1ubuntu4.2+esm2"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2","4.2.6~dfsg-1ubuntu4.2+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10.0~dfsg-2ubuntu0.4+esm2"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4","8.10.0~dfsg-2ubuntu0.4+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.19.0~dfsg-3ubuntu1.1"}]}],"versions":["10.15.2~dfsg-2ubuntu1","10.17.0~dfsg-2ubuntu4","10.17.0~dfsg-2ubuntu6","10.19.0~dfsg-3ubuntu1"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-lp151.2.12.1"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"nodejs","product":"node"},{"vendor":"nodejs","product":"node.js"},{"vendor":"opensuse","product":"leap"},{"vendor":"oracle","product":"communications_cloud_native_core_network_function_cloud_native_environment"},{"vendor":"oracle","product":"graalvm"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"software_collections"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2020:0573","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0579","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0597","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0598","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0602","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202003-48","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2020/dsa-4669","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://hackerone.com/reports/746733","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://nodejs.org/en/blog/release/v13.8.0/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"https://nodejs.org/en/blog/release/v10.19.0/","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://nodejs.org/en/blog/release/v12.15.0/","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20200221-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15604","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/release/v10.19.0"},{"url":"https://nodejs.org/en/blog/release/v12.15.0"},{"url":"https://nodejs.org/en/blog/release/v13.8.0"},{"url":"https://nodejs.org/en/blog/vulnerability/february-2020-security-releases"},{"url":"https://security.netapp.com/advisory/ntap-20200221-0004"},{"url":"https://github.com/advisories/GHSA-4p8g-wmmc-p9f7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-15604","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2020-0579.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-15604","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-15605","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-15606","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-16775","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-16776","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-16777","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2020-0598.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-15604","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-15604","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0372.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25314","tags":["report"]},{"url":"https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/december-2019-security-releases/","tags":["web"]},{"url":"https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/","tags":["web"]},{"url":"https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/","tags":["web"]},{"url":"https://github.com/nodejs/node/blob/v10.x/doc/changelogs/CHANGELOG_V10.md","tags":["web"]},{"url":"https://github.com/nghttp2/nghttp2/releases/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788301","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788305","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1800364","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1800366","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1800367","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0573.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15604","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15604","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15605","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15605","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15605","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15606","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15606","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15606","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16775","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16775","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16775","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16776","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16776","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16776","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16777","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16777","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16777","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0579.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0597.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0598.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0602.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2020:0579","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2020:0598","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200427-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1163102","tags":["report"]},{"url":"https://bugzilla.suse.com/1163103","tags":["report"]},{"url":"https://bugzilla.suse.com/1163104","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15606","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200429-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1159352","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16777","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200454-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200455-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200488-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-15604","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6380-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-15605","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-15606","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-8174","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-8265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-8287","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LLBX73ZML2HFTXADVLS3JFSWUPDITBSK/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-15604","description":"Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate","status":"published","published":"2020-02-07T14:57:07Z","modified":"2025-04-30T22:24:22.492Z","cwes":["CWE-295"],"updated_at":"2026-11-02T14:20:21.059499Z"}],"euvd":[{"id":"EUVD-2019-6564","description":"Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate","status":"published","published":"2020-02-07T14:57:07Z","modified":"2025-04-30T22:24:22Z","updated_at":"2026-11-02T20:51:58.065214Z"}],"ghsa":[{"id":"GHSA-4p8g-wmmc-p9f7","title":"Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when...","description":"Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate","status":"published","published":"2022-05-24T17:08:13Z","modified":"2024-03-07T21:30:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:55:39.473736Z"}],"nvd":[{"id":"CVE-2019-15604","description":"Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate","status":"published","published":"2020-02-07T15:15:11.18Z","modified":"2026-06-17T02:20:43.643Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:05:43.875329Z"}],"osv":[{"id":"ALPINE-CVE-2019-15604","description":"Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate","status":"published","published":"2020-02-07T15:15:11.18Z","modified":"2026-11-03T06:30:09.402290461Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T06:41:39.834803Z"},{"id":"BELL-CVE-2019-15604","title":"CVE-2019-15604 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:12.178361Z","modified":"2026-02-18T07:38:20.880651Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-15604","description":"Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate","status":"published","published":"2020-02-07T15:15:11.18Z","modified":"2026-10-24T10:31:04.614099741Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.361782Z"},{"id":"DEBIAN-CVE-2019-15604","description":"Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate","status":"published","published":"2020-02-07T15:15:11.18Z","modified":"2026-09-21T07:02:11.774204728Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"RHSA-2020:0573","title":"Red Hat Security Advisory: nodejs:10 security update","status":"published","published":"2024-09-13T16:15:55Z","modified":"2026-06-29T10:28:51Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0579","title":"Red Hat Security Advisory: nodejs:10 security update","status":"published","published":"2024-09-13T16:16:24Z","modified":"2026-06-29T10:28:52Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0597","title":"Red Hat Security Advisory: rh-nodejs10-nodejs security update","status":"published","published":"2024-09-13T16:16:13Z","modified":"2026-06-29T10:28:54Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0598","title":"Red Hat Security Advisory: nodejs:12 security update","status":"published","published":"2024-09-13T16:16:32Z","modified":"2026-06-29T10:28:55Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0602","title":"Red Hat Security Advisory: rh-nodejs12-nodejs security update","status":"published","published":"2024-09-13T16:15:44Z","modified":"2026-06-29T10:28:56Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RLSA-2020:0579","title":"Important: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.\n\nThe following packages have been upgraded to a later upstream version: nodejs (10.19.0).\n\nSecurity Fix(es):\n\n* nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)\n\n* nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)\n\n* nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)\n\n* npm: Symlink reference outside of node_modules folder through the bin field upon installation (CVE-2019-16775)\n\n* npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)\n\n* npm: Global node_modules Binary Overwrite (CVE-2019-16777)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2020-02-25T07:57:02Z","modified":"2026-02-05T01:15:07.968339Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2020:0598","title":"Important: nodejs:12 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.\n\nThe following packages have been upgraded to a later upstream version: nodejs (12.16.1).\n\nSecurity Fix(es):\n\n* nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)\n\n* nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)\n\n* nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2020-02-25T13:06:23Z","modified":"2026-02-04T20:15:14.048516Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-15604","description":"Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate","status":"published","published":"2020-02-07T15:15:00Z","modified":"2026-04-22T12:12:02.272873Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"ALSA-2020:0579","title":"Important: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.\n\nThe following packages have been upgraded to a later upstream version: nodejs (10.19.0).\n\nSecurity Fix(es):\n\n* nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)\n\n* nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)\n\n* nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)\n\n* npm: Symlink reference outside of node_modules folder through the bin field upon installation (CVE-2019-16775)\n\n* npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)\n\n* npm: Global node_modules Binary Overwrite (CVE-2019-16777)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2020-02-25T07:57:02Z","modified":"2026-10-29T11:00:05.743563773Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2020:0598","title":"Important: nodejs:12 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.\n\nThe following packages have been upgraded to a later upstream version: nodejs (12.16.1).\n\nSecurity Fix(es):\n\n* nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)\n\n* nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)\n\n* nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2020-02-25T13:06:23Z","modified":"2026-10-29T11:00:07.005569471Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DSA-4669-1","title":"nodejs - security update","status":"published","published":"2020-04-29T00:00:00Z","modified":"2026-03-09T02:10:02.269336Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0372","title":"Updated nodejs packages fix security vulnerabilities","description":"The nodejs package has been updated to the latest version in the 10.x branch,\nwhich is 10.22.1 at this time.  It fixes several security issues and other\nbugs.  See the upstream changelog and advisories for details.\n","status":"published","published":"2020-09-27T20:06:37Z","modified":"2026-04-16T04:43:16.918624291Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:0293-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).\n- CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).\n- CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-03-03T17:13:16Z","modified":"2026-02-04T04:12:22.667167Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"SUSE-SU-2020:0427-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\nnodejs10 was updated to version 10.19.0.\n\nSecurity issues fixed:\n\n- CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).\n- CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).\n- CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).\n","status":"published","published":"2020-02-20T10:05:04Z","modified":"2026-02-04T03:08:50.997309Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0429-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\nnodejs12 was updated to version 12.15.0.\n\nSecurity issues fixed:\n\n- CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).\n- CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).\n- CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).\n- CVE-2019-16775: Fixed an arbitrary file write vulnerability (bsc#1159352).\n- CVE-2019-16776: Fixed an arbitrary file write vulnerability (bsc#1159352).\n- CVE-2019-16777: Fixed an arbitrary file write vulnerability (bsc#1159352).\n","status":"published","published":"2020-02-20T12:28:28Z","modified":"2026-02-04T03:33:18.665432Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0454-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).\n- CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).\n- CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).\n","status":"published","published":"2020-02-25T09:55:38Z","modified":"2026-02-04T03:58:26.899465Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0455-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\nnodejs10 was updated to version 10.19.0.\n\nSecurity issues fixed:\n\n- CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).\n- CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).\n- CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).\n","status":"published","published":"2020-02-25T09:56:23Z","modified":"2026-02-04T04:22:44.143472Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0488-1","title":"Security update for nodejs6","description":"This update for nodejs6 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).\n- CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).\n- CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).\n","status":"published","published":"2020-02-26T10:43:42Z","modified":"2026-02-04T03:26:12.633306Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-6380-1","title":"nodejs vulnerabilities","description":"Rogier Schouten discovered that Node.js incorrectly handled certain inputs. If\na user or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to cause a denial\nof service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. \n(CVE-2019-15604)\n\nEthan Rubinson discovered that Node.js incorrectly handled certain inputs. If\na user or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to obtain\nsensitive information. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2019-15605)\n\nAlyssa Wilk discovered that Node.js incorrectly handled certain inputs. If a\nuser or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2019-15606)\n\nTobias Niessen discovered that Node.js incorrectly handled certain inputs. If\na user or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to cause a\ndenial of service. This issue only affected Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2020-8174)\n\nIt was discovered that Node.js incorrectly handled certain inputs. If a user\nor an automated system were tricked into opening a specially crafted input\nfile, a remote attacker could possibly use this issue to cause a\ndenial of service. (CVE-2020-8265, CVE-2020-8287)\n","status":"published","published":"2023-09-19T07:18:15Z","modified":"2026-06-25T13:32:20.979176372Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}