CVE-2019-15605
published 2020-02-07CVE-2019-15605: HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
PriorityP266critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
57.13%
99.0th percentile
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
Affected
47 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | http-parser | < http-parser 2.9.4-2 (bookworm) | http-parser 2.9.4-2 (bookworm) |
| debian | nodejs | < http-parser 2.9.4-2 (bookworm) | http-parser 2.9.4-2 (bookworm) |
| fedoraproject | fedora | — | — |
| github.com | apple_swift-nio | >= 1.0.0 < 1.14.2 | 1.14.2 |
| github.com | apple_swift-nio | >= 2.0.0 < 2.13.1 | 2.13.1 |
| nodejs | node | >= 10.0 < 10.19.0 | 10.19.0 |
| nodejs | node | >= 11.0 < 11.* | 11.* |
| nodejs | node | >= 12.0 < 12.15.0 | 12.15.0 |
| nodejs | node | >= 13.0 < 13.8.0 | 13.8.0 |
| nodejs | node | >= 4.0 < 4.* | 4.* |
| nodejs | node | >= 5.0 < 5.* | 5.* |
| nodejs | node | >= 6.0 < 6.* | 6.* |
| nodejs | node | >= 7.0 < 7.* | 7.* |
| nodejs | node | >= 8.0 < 8.* | 8.* |
| nodejs | node | >= 9.0 < 9.* | 9.* |
| nodejs | node.js | >= 10.0.0 < 10.19.0 | 10.19.0 |
| nodejs | node.js | >= 12.0.0 < 12.15.0 | 12.15.0 |
| nodejs | node.js | >= 13.0.0 < 13.8.0 | 13.8.0 |
| nodejs | nodejs | >= 0 < 10.19.0~dfsg-1 | 10.19.0~dfsg-1 |
| nodejs | nodejs | >= 0 < 10.19.0~dfsg-1 | 10.19.0~dfsg-1 |
| nodejs | nodejs | >= 0 < 10.19.0~dfsg-1 | 10.19.0~dfsg-1 |
| nodejs | nodejs | >= 0 < 10.19.0~dfsg-1 | 10.19.0~dfsg-1 |
| nodejs | nodejs | >= 0 < 10.19.0~dfsg-3ubuntu1.1 | 10.19.0~dfsg-3ubuntu1.1 |
| nodejs | nodejs | >= 0 < 4.2.6~dfsg-1ubuntu4.2+esm2 | 4.2.6~dfsg-1ubuntu4.2+esm2 |
Detection & IOCsextracted from sources · hover to see the quote
- →The attack vector is a specially crafted HTTP request with a malformed Transfer-Encoding header, enabling HTTP request smuggling / desync attacks against Node.js servers deployed behind a proxy that reuses connections. ↗
- →Monitor for HTTP requests containing malformed or obfuscated Transfer-Encoding headers (e.g., with whitespace, unusual casing, or extra characters) targeting Node.js HTTP servers, which is the root trigger for this smuggling vulnerability. ↗
- →Payloads crafted via this smuggling flaw can be used to hijack user sessions, poison cookies, and perform clickjacking — monitor for unexpected session/cookie manipulation in responses proxied through Node.js. ↗
- ·Vulnerability exists in Node.js versions 10, 12, and 13 specifically; fixed in Node.js v10.19.0, v12.15.0, and v13.8.0. Verify the deployed Node.js version before applying detection logic. ↗
- ·The underlying parser fix is in http-parser (C library) at the referenced commit; the fix is also present in http-parser-js 2.9.3+. Environments using the C http-parser library separately (e.g., Fedora/RHEL packages) must patch that component independently. ↗
- ·Red Hat Quay 3 is explicitly listed as NOT affected by this CVE. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
nodejs vulnerabilities
osv·2023-09-19·CVSS 7.5
CVE-2019-15604 [HIGH] nodejs vulnerabilities
nodejs vulnerabilities
Rogier Schouten discovered that Node.js incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
(CVE-2019-15604)
Ethan Rubinson discovered that Node.js incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS. (CVE-2019-15605)
Alyssa Wilk discovered that Node.js incorrectly handled certain inputs. If a
user or an automated system were tricked in
GHSA
SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header
ghsa·2023-05-18
[CRITICAL] CWE-444 SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header
SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header
### Impact
Affected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures of authentication, routing, and other issues.
This vulnerability can be found in the bundled copy of the Node.JS HTTP parser used in the `NIOHTTP1` module.
### Workarounds
No workaround is available, users must upgrade.
### References
https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/#http-request-smuggling-using-malformed-transfer-encoding-header-critical-cve-2019-15605
OSV
SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header
osv·2023-05-18
[CRITICAL] SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header
SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header
### Impact
Affected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures of authentication, routing, and other issues.
This vulnerability can be found in the bundled copy of the Node.JS HTTP parser used in the `NIOHTTP1` module.
### Workarounds
No workaround is available, users must upgrade.
### References
https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/#http-request-smuggling-using-malformed-transfer-encoding-header-critical-cve-2019-15605
GHSA
GHSA-rv6p-2q56-m955: HTTP request smuggling in Node
ghsa_unreviewed·2022-05-24
CVE-2019-15605 [HIGH] CWE-444 GHSA-rv6p-2q56-m955: HTTP request smuggling in Node
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
OSV
CVE-2019-15605: HTTP request smuggling in Node
osv·2020-02-07·CVSS 9.8
CVE-2019-15605 [CRITICAL] CVE-2019-15605: HTTP request smuggling in Node
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
Ubuntu
Node.js vulnerabilities
vendor_ubuntu·2023-09-19·CVSS 7.5
CVE-2019-15604 [HIGH] Node.js vulnerabilities
Title: Node.js vulnerabilities
Summary: Several security issues were fixed in Node.js.
Rogier Schouten discovered that Node.js incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
(CVE-2019-15604)
Ethan Rubinson discovered that Node.js incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS. (CVE-2019-15605)
Alyssa Wilk discovered that Node.js incorrectly handled
Red Hat
nodejs: HTTP request smuggling using malformed Transfer-Encoding header
vendor_redhat·2020-02-07·CVSS 9.8
CVE-2019-15605 [CRITICAL] CWE-444 nodejs: HTTP request smuggling using malformed Transfer-Encoding header
nodejs: HTTP request smuggling using malformed Transfer-Encoding header
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
A flaw was found in the Node.js code where a specially crafted HTTP(s) request sent to a Node.js server failed to properly process the HTTP(s) headers, resulting in a request smuggling attack. An attacker can use this flaw to alter a request sent as an authenticated user if the Node.js server is deployed behind a proxy server that reuses connections.
Package: quay (Red Hat Quay 3) - Not affected
Debian
CVE-2019-15605: http-parser - HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delive...
vendor_debian·2019·CVSS 9.8
CVE-2019-15605 [CRITICAL] CVE-2019-15605: http-parser - HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delive...
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
Scope: local
bookworm: resolved (fixed in 2.9.4-2)
bullseye: resolved (fixed in 2.9.4-2)
forky: resolved (fixed in 2.9.4-2)
sid: resolved (fixed in 2.9.4-2)
trixie: resolved (fixed in 2.9.4-2)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-15605 http-parser: nodejs: HTTP request smuggling using malformed Transfer-Encoding header [fedora-all]
bugzilla·2020-02-13·CVSS 9.8
CVE-2019-15605 [CRITICAL] CVE-2019-15605 http-parser: nodejs: HTTP request smuggling using malformed Transfer-Encoding header [fedora-all]
CVE-2019-15605 http-parser: nodejs: HTTP request smuggling using malformed Transfer-Encoding header [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue
Bugzilla
CVE-2019-15605 nodejs: HTTP request smuggling using malformed Transfer-Encoding header
bugzilla·2020-02-07·CVSS 9.8
CVE-2019-15605 [CRITICAL] CVE-2019-15605 nodejs: HTTP request smuggling using malformed Transfer-Encoding header
CVE-2019-15605 nodejs: HTTP request smuggling using malformed Transfer-Encoding header
Affected Node.js versions can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system.
Downloads & release details
* Node.js v10.19.0 (LTS) - https://nodejs.org/en/blog/release/v10.19.0/
* Node.js v12.15.0 (LTS) - https://nodejs.org/en/blog/release/v12.15.0/
* Node.js v13.8.0 (LTS) - https://nodejs.org/en/blog/release/v13.8.0/
Discussion:
Created nodejs tracking bugs for this issue:
Affects: fedora-all [bug 1800376]
---
Also fixed in http-parser-js 2.9.3 see: https
Bugzilla
CVE-2019-15605 nodejs: HTTP request smuggling using malformed Transfer-Encoding header [fedora-all]
bugzilla·2020-02-07·CVSS 9.8
CVE-2019-15605 [CRITICAL] CVE-2019-15605 nodejs: HTTP request smuggling using malformed Transfer-Encoding header [fedora-all]
CVE-2019-15605 nodejs: HTTP request smuggling using malformed Transfer-Encoding header [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multi
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.htmlhttps://access.redhat.com/errata/RHSA-2020:0573https://access.redhat.com/errata/RHSA-2020:0579https://access.redhat.com/errata/RHSA-2020:0597https://access.redhat.com/errata/RHSA-2020:0598https://access.redhat.com/errata/RHSA-2020:0602https://access.redhat.com/errata/RHSA-2020:0703https://access.redhat.com/errata/RHSA-2020:0707https://access.redhat.com/errata/RHSA-2020:0708https://hackerone.com/reports/735748https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CT3WTR4P5VAJ3GJGKPYEDUPTNZ3IEDUR/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLB676PDU4RJQLWQUA277YNGYYNEYGWO/https://nodejs.org/en/blog/release/v10.19.0/https://nodejs.org/en/blog/release/v12.15.0/https://nodejs.org/en/blog/release/v13.8.0/https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/https://security.gentoo.org/glsa/202003-48https://security.netapp.com/advisory/ntap-20200221-0004/https://www.debian.org/security/2020/dsa-4669https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2020.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.htmlhttps://access.redhat.com/errata/RHSA-2020:0573https://access.redhat.com/errata/RHSA-2020:0579https://access.redhat.com/errata/RHSA-2020:0597https://access.redhat.com/errata/RHSA-2020:0598https://access.redhat.com/errata/RHSA-2020:0602https://access.redhat.com/errata/RHSA-2020:0703https://access.redhat.com/errata/RHSA-2020:0707https://access.redhat.com/errata/RHSA-2020:0708https://hackerone.com/reports/735748https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CT3WTR4P5VAJ3GJGKPYEDUPTNZ3IEDUR/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLB676PDU4RJQLWQUA277YNGYYNEYGWO/https://nodejs.org/en/blog/release/v10.19.0/https://nodejs.org/en/blog/release/v12.15.0/https://nodejs.org/en/blog/release/v13.8.0/https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/https://security.gentoo.org/glsa/202003-48https://security.netapp.com/advisory/ntap-20200221-0004/https://www.debian.org/security/2020/dsa-4669https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2020.html
2020-02-07
Published