Authorization Bypass Vulnerability in Node.js Due to Trailing White Space in HTTP Headers
Summary
ALPINE-CVE-2019-15606: Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons. Affects nodejs versions < 10.19.0-r0. Fixed in 10.19.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source JavaScript runtime built on Chrome's V8 JavaScript engine, allowing developers to build scalable network applications. It is widely used for server-side development and is known for its non-blocking, event-driven architecture. However, certain versions of Node.js are vulnerable to an authorization bypass issue caused by the inclusion of trailing white space in HTTP header values, which can lead to security risks in applications relying on header value comparisons.
Vulnerability Detail
The vulnerability, identified as CVE-2019-15606, arises from the way Node.js handles trailing white space in HTTP header values. When such values are included, they can bypass authorization checks that depend on strict header value comparisons. This can allow unauthorized access to resources, potentially leading to data breaches or other malicious activities. The vulnerability affects Node.js versions 10, 12, and 13, and has a CVSS score of 9.8, indicating a critical severity level.
How To Fix
Minimum fixed version
10.19.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement input validation to strip trailing white space from HTTP header values before processing them. This can be done using middleware in the application code. For example, in an Express.js application, you can add the following middleware:
app.use((req, res, next) => {
for (const header in req.headers) {
req.headers[header] = req.headers[header].trim();
}
next();
});
Conclusion
The CVE-2019-15606 vulnerability in Node.js poses a significant risk due to its potential for unauthorized access through HTTP header manipulation. It is crucial for developers to update to the patched versions of Node.js to mitigate this risk and ensure the security of their applications. Implementing workarounds can provide temporary relief until updates are applied.
See every vulnerability recorded for nodejs →
FAQ
CVE-2019-15606 is a vulnerability in Node.js that allows unauthorized access due to trailing white space in HTTP header values.
The affected versions include Node.js 10, 12, and 13.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 9.8, indicating a critical severity level.
If immediate updates are not possible, implement input validation to strip trailing white space from HTTP header values as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
