CVE-2019-15606

🗓️ 07 Feb 2020 14:58:08Reported by hackeroneType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 317 Views

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorizatio

Reporter	Title	Published	Views	Family All 149
FreeBSD	Node.js -- multiple vulnerabilities	6 Feb 202000:00	–	freebsd
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affects IBM App Connect Enterprise V11	6 May 202011:05	–	ibm
IBM Security Bulletins	Security Bulletin: Version 10.16.3 of Node.js included in IBM Cloud Event Management 2.5.0 has several security vulnerabilities.	16 Apr 202005:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Cloud App Management	21 Jul 202213:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is affected by multiple Node.js vulnerabilities	11 Jun 202016:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is affected by multiple Node.js vulnerabilities.	15 Sep 202009:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Planning Analytics Workspace	3 Nov 202015:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in Node.js	8 Jun 202122:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM API Connect is impacted by vulnerabilities in Node.js(CVE-2019-15604, CVE-2019-15605, CVE-2019-15606)	11 May 202018:05	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Pak for Data - Node.js (CVE-2019-15606, CVE-2019-15604, CVE-2019-15605)	6 Oct 202022:54	–	ibm

NVD

Vulners

Node

nodejs node.jsRange10.0.0–10.19.0lts

nodejs node.jsRange12.0.0–12.15.0lts

nodejs node.jsRange13.0.0–13.8.0-

Node

oracle communications_cloud_native_core_network_function_cloud_native_environmentMatch1.4.0

oracle graalvmMatch19.3.1enterprise

oracle graalvmMatch20.0.0enterprise

Node

debian debian_linuxMatch10.0

Node

redhat enterprise_linuxMatch8.0

redhat enterprise_linux_eusMatch8.1

Node

opensuse leapMatch15.1

[
  {
    "product": "Node",
    "vendor": "NodeJS",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "4.0",
        "status": "affected",
        "lessThan": "4.*"
      },
      {
        "versionType": "semver",
        "version": "5.0",
        "status": "affected",
        "lessThan": "5.*"
      },
      {
        "versionType": "semver",
        "version": "6.0",
        "status": "affected",
        "lessThan": "6.*"
      },
      {
        "versionType": "semver",
        "version": "7.0",
        "status": "affected",
        "lessThan": "7.*"
      },
      {
        "versionType": "semver",
        "version": "8.0",
        "status": "affected",
        "lessThan": "8.*"
      },
      {
        "versionType": "semver",
        "version": "9.0",
        "status": "affected",
        "lessThan": "9.*"
      },
      {
        "versionType": "semver",
        "version": "10.0",
        "status": "affected",
        "lessThan": "10.19.0"
      },
      {
        "versionType": "semver",
        "version": "11.0",
        "status": "affected",
        "lessThan": "11.*"
      },
      {
        "versionType": "semver",
        "version": "12.0",
        "status": "affected",
        "lessThan": "12.15.0"
      },
      {
        "versionType": "semver",
        "version": "13.0",
        "status": "affected",
        "lessThan": "13.8.0"
      }
    ]
  }
]

Source	Link
access	www.access.redhat.com/errata/RHSA-2020:0579
debian	www.debian.org/security/2020/dsa-4669
nodejs	www.nodejs.org/en/blog/release/v10.19.0/
oracle	www.oracle.com//security-alerts/cpujul2021.html
nodejs	www.nodejs.org/en/blog/release/v13.8.0/
lists	www.lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html
security	www.security.gentoo.org/glsa/202003-48
security	www.security.netapp.com/advisory/ntap-20200221-0004/
access	www.access.redhat.com/errata/RHSA-2020:0598
nodejs	www.nodejs.org/en/blog/vulnerability/february-2020-security-releases/

30 Apr 2025 22:24Current

9.4High risk

Vulners AI Score9.4

CVSS 27.5

CVSS 3.19.8

EPSS0.01338

CWE-20