CVE-2019-15605

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-444

Affected software

VendorProductVersions
NodeJSNode>= 4.0, < 4.*; >= 5.0, < 5.*; >= 6.0, < 6.*; >= 7.0, < 7.*; >= 8.0, < 8.*; >= 9.0, < 9.*; >= 10.0, < 10.19.0; >= 11.0, < 11.*; >= 12.0, < 12.15.0; >= 13.0, < 13.8.0

References

Timeline

Published
Feb 7, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-156069.8Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisoCVE-2019-156075.4A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of ThCVE-2019-156085.9The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cacCVE-2019-156099.8The kill-port-process package version < 2.2.0 is vulnerable to a Command Injection vulnerability.CVE-2019-156104.3Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle.CVE-2019-156114.9Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when searCVE-2019-156125.9A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset.CVE-2019-156138.0A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes.CVE-2019-156145.4Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files.CVE-2019-156156.1A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to thCVE-2019-156164.3Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.CVE-2019-156175.4A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login.