CVE-2019-15606: Input Validation
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
Other sources
Node.js could allow a remote attacker to bypass security restrictions, caused by an issue when HTTP header values do not have trailing OWS trimmed. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass authorization based on header value comparisons.
— IBM
Optional whitespace should be trimmed from HTTP header values. Its presence may allow attackers to bypass security checks based on HTTP header values.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-15606?
CVE-2019-15606 is a vulnerability in Nodejs 10, 12, and 13 that allows bypass of authorization based on header value comparisons by including trailing white space in HTTP header values.
What is the severity of CVE-2019-15606?
The severity of CVE-2019-15606 is medium, with a severity value of 4.
How does CVE-2019-15606 affect Nodejs?
CVE-2019-15606 affects Nodejs versions 10, 12, and 13.
How can the CVE-2019-15606 vulnerability be fixed?
To fix the CVE-2019-15606 vulnerability, update Nodejs to the recommended versions: 10.24.0~dfsg-1~deb10u1, 10.24.0~dfsg-1~deb10u3, 12.22.12~dfsg-1~deb11u3, 12.22.12~dfsg-1~deb11u4, or 18.13.0+dfsg1-1.
Where can I find more information about CVE-2019-15606?
You can find more information about CVE-2019-15606 at the following references: [1] HackerOne report: https://hackerone.com/reports/730779 [2] Nodejs commit: https://github.com/nodejs/node/commit/2eee90e959ca4abaf53caf238d063c396f2ea17c [3] Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2019-15606