CVE-2019-15606

Node.js versions 10, 12, and 13 allow attackers to bypass security checks by adding extra spaces at the end of HTTP headers. If a server checks header values to authorize requests, an attacker can add trailing spaces to fool the check.

HTTP header values containing trailing whitespace are not properly normalized in Node.js 10, 12, and 13, allowing attackers to bypass authorization mechanisms that rely on strict header value comparison. The attack vector involves crafted HTTP requests with whitespace-padded header values; impact includes circumvention of access controls based on header validation.