CVE-2019-15606: vulnerability in NodeJS Node
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Node.js versions 10, 12, and 13 allow attackers to bypass security checks by adding extra spaces at the end of HTTP headers. If a server checks header values to authorize requests, an attacker can add trailing spaces to fool the check.
HTTP header values containing trailing whitespace are not properly normalized in Node.js 10, 12, and 13, allowing attackers to bypass authorization mechanisms that rely on strict header value comparison. The attack vector involves crafted HTTP requests with whitespace-padded header values; impact includes circumvention of access controls based on header validation.
In the same product, most dangerous first.