← Back

CVE-2019-15605

nvd nist
Published: Feb 7, 2020Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Affected (26)

Products: Nodejs: Node.js · Debian: Debian Linux · Fedoraproject: Fedora · +3 more
Show all products
Nodejs: Node.js · Debian: Debian Linux · Fedoraproject: Fedora · Opensuse: Leap · Redhat: Enterprise Linux, Enterprise Linux Desktop, Enterprise Linux Eus, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Server Tus, Enterprise Linux Workstation, Software Collections · Oracle: Graalvm
Nodejs
1 product
Node.js
Debian
1 product
Debian Linux
Fedoraproject
1 product
Fedora
Opensuse
1 product
Leap
Redhat
8 products
Enterprise Linux
Enterprise Linux Desktop
Enterprise Linux Eus
Enterprise Linux Server
Enterprise Linux Server Aus
Enterprise Linux Server Tus
Enterprise Linux Workstation
Software Collections
Oracle
1 product
Graalvm
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Nodejs
Node.js
From 13.0.0 to 13.8.0
Node.js
From 10.0.0 to 10.19.0
Node.js
From 12.0.0 to 12.15.0
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Debian Linux
Version 10.0
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Fedora
Version 30
Configuration D
1 vulnerable
Vulnerable SoftwareAffected Versions
Leap
Version 15.1
Configuration E
18 vulnerable
Vulnerable SoftwareAffected Versions
Enterprise Linux
Version 8.0
Enterprise Linux Desktop
Version 7.0
Redhat
Enterprise Linux Eus
Version 7.7
Enterprise Linux Eus
Version 8.1
Enterprise Linux Eus
Version 8.2
Enterprise Linux Eus
Version 8.4
Enterprise Linux Eus
Version 8.6
Enterprise Linux Server
Version 7.0
Redhat
Enterprise Linux Server Aus
Version 7.7
Enterprise Linux Server Aus
Version 8.2
Enterprise Linux Server Aus
Version 8.4
Enterprise Linux Server Aus
Version 8.6
Redhat
Enterprise Linux Server Tus
Version 7.7
Enterprise Linux Server Tus
Version 8.2
Enterprise Linux Server Tus
Version 8.4
Enterprise Linux Server Tus
Version 8.6
Enterprise Linux Workstation
Version 7.0
Software Collections
Version 1.0
Configuration F
2 vulnerable
Vulnerable SoftwareAffected Versions
Oracle
Graalvm
Version 19.3.1
Graalvm
Version 20.0.0

Related CWEs

CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

References (42)

Source: support@hackerone.com
Mailing ListThird Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Permissions RequiredThird Party Advisory
Source: support@hackerone.com
Source: support@hackerone.com
Source: support@hackerone.com
Release NotesVendor Advisory
Source: support@hackerone.com
Release NotesVendor Advisory
Source: support@hackerone.com
Vendor Advisory
Source: support@hackerone.com
Vendor Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
PatchThird Party Advisory
Source: support@hackerone.com
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Permissions RequiredThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.