Critical severity9.8NVD Advisory· Published Feb 7, 2020· Updated Jun 17, 2026
CVE-2019-15605
CVE-2019-15605
Description
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
48cpe:2.3:a:oracle:graalvm:19.3.1:*:*:*:enterprise:*:*:*+ 1 more
- cpe:2.3:a:oracle:graalvm:19.3.1:*:*:*:enterprise:*:*:*
- cpe:2.3:a:oracle:graalvm:20.0.0:*:*:*:enterprise:*:*:*
- cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
- osv-coords21 versionspkg:rpm/almalinux/nodejs-nodemonpkg:rpm/almalinux/nodejs-packagingpkg:rpm/opensuse/nodejs8&distro=openSUSE%20Leap%2015.1pkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015pkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP1pkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/nodejs6&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/nodejs6&distro=SUSE%20OpenStack%20Cloud%207pkg:rpm/suse/nodejs6&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/nodejs6&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209pkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015pkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP1pkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015
< 1.18.3-1.module_el8.3.0+2023+d2377ea3+ 20 more
- (no CPE)range: < 1.18.3-1.module_el8.3.0+2023+d2377ea3
- (no CPE)range: < 17-3.module_el8.4.0+2224+b07ac28e
- (no CPE)range: < 8.17.0-lp151.2.12.1
- (no CPE)range: < 10.19.0-1.18.1
- (no CPE)range: < 10.19.0-1.18.1
- (no CPE)range: < 10.19.0-1.18.1
- (no CPE)range: < 10.19.0-1.18.1
- (no CPE)range: < 10.19.0-1.18.1
- (no CPE)range: < 10.19.0-1.18.1
- (no CPE)range: < 10.19.0-1.18.1
- (no CPE)range: < 12.15.0-1.6.1
- (no CPE)range: < 6.17.1-11.33.1
- (no CPE)range: < 6.17.1-11.33.1
- (no CPE)range: < 6.17.1-11.33.1
- (no CPE)range: < 6.17.1-11.33.1
- (no CPE)range: < 8.17.0-3.28.1
- (no CPE)range: < 8.17.0-3.28.1
- (no CPE)range: < 8.17.0-3.28.1
- (no CPE)range: < 8.17.0-3.28.1
- (no CPE)range: < 8.17.0-3.28.1
- (no CPE)range: < 8.17.0-3.28.1
Patches
Vulnerability mechanics
References
21- www.oracle.com//security-alerts/cpujul2021.htmlnvdPatchThird Party Advisory
- www.oracle.com/security-alerts/cpuapr2020.htmlnvdPatchThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.htmlnvdMailing ListThird Party Advisory
- access.redhat.com/errata/RHSA-2020:0573nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2020:0579nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2020:0597nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2020:0598nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2020:0602nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2020:0703nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2020:0707nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2020:0708nvdThird Party Advisory
- hackerone.com/reports/735748nvdPermissions RequiredThird Party Advisory
- nodejs.org/en/blog/release/v10.19.0/nvdRelease NotesVendor Advisory
- nodejs.org/en/blog/release/v12.15.0/nvdRelease NotesVendor Advisory
- nodejs.org/en/blog/release/v13.8.0/nvdVendor Advisory
- nodejs.org/en/blog/vulnerability/february-2020-security-releases/nvdVendor Advisory
- security.gentoo.org/glsa/202003-48nvdThird Party Advisory
- security.netapp.com/advisory/ntap-20200221-0004/nvdThird Party Advisory
- www.debian.org/security/2020/dsa-4669nvdThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CT3WTR4P5VAJ3GJGKPYEDUPTNZ3IEDUR/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLB676PDU4RJQLWQUA277YNGYYNEYGWO/nvd
News mentions
0No linked articles in our index yet.