Critical HTTP Request Smuggling Vulnerability in Node.js Package
Summary
ALPINE-CVE-2019-15605: HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed. Affects nodejs versions < 10.19.0-r0. Fixed in 10.19.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications and has a rich ecosystem of libraries and frameworks. The Node.js package is integral for many web applications, enabling asynchronous event-driven programming. However, it has been found to be vulnerable to a critical issue that could allow attackers to exploit the HTTP request smuggling vulnerability, impacting the security of applications built on this platform.
Vulnerability Detail
The vulnerability identified as CVE-2019-15605 is a critical HTTP request smuggling flaw present in Node.js versions 10, 12, and 13. This vulnerability arises from improper handling of the 'Transfer-Encoding' header, which can lead to malicious payload delivery. Attackers can exploit this flaw to bypass security controls, potentially leading to unauthorized access, data leakage, or further exploitation of the application. The CVSS score for this vulnerability is 9.8, indicating a high severity level.
How To Fix
Minimum fixed version
10.19.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider implementing strict validation of incoming HTTP requests to mitigate the risk of exploitation until the package can be updated. This may involve checking for proper formatting of headers and rejecting requests that do not conform to expected standards.
Conclusion
The CVE-2019-15605 vulnerability in Node.js poses a significant risk to applications utilizing this package. It is crucial to update to the patched versions to mitigate potential exploitation. Additionally, implementing temporary workarounds can help secure applications until updates are applied.
See every vulnerability recorded for nodejs →
FAQ
HTTP request smuggling is a technique used by attackers to send malicious requests that can bypass security measures, leading to unauthorized actions or data exposure.
Node.js versions 10, 12, and 13 are affected by the CVE-2019-15605 vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement strict validation of HTTP requests as a temporary workaround to reduce the risk of exploitation.
The CVSS score for CVE-2019-15605 is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
