Vulnerabilities

TI-2019-11705 CVE-2019-15606 · GHSA-3qv8-368w-r69p

Improper input validation in NodeJS Node

MEDIUM 61

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.20041 Published 2020-02-07 Fixed in 10.19.0, 12.15.0 +1 CWE-20

TI-2019-11703 CVE-2019-15604 · GHSA-4p8g-wmmc-p9f7

MEDIUM 51

Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.19966 Published 2020-02-07 Fixed in 10.19.0, 12.15.0 +1 CWE-295

TI-2019-11704 CVE-2019-15605 · GHSA-rv6p-2q56-m955

HIGH 75

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.57132 Published 2020-02-07 Fixed in 10.19.0, 12.15.0 +1 CWE-444