Critical HTTP Request Smuggling Vulnerability in Node.js Package
Summary
UBUNTU-CVE-2019-15605: HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed. Affects nodejs versions 0.10.15~dfsg1-4 – 0.10.25~dfsg2-2ubuntu1.2+esm2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable network applications and is widely used for server-side programming. The Node.js package is essential for running JavaScript on the server, but it has been found to be vulnerable to HTTP request smuggling, which can lead to severe security issues.
Vulnerability Detail
The vulnerability, identified as CVE-2019-15605, arises from improper handling of HTTP requests in Node.js versions 10, 12, and 13. This flaw allows attackers to exploit malformed transfer-encoding headers, potentially leading to the delivery of malicious payloads. The ramifications include unauthorized access to sensitive data, data corruption, and the ability to execute arbitrary code on affected systems. The CVSS score for this vulnerability is 9.8, indicating a critical severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can configure your web server to reject requests with malformed transfer-encoding headers. This can help mitigate the risk until the package is updated. For example, in an Nginx configuration, you can add the following directive:
if ($http_transfer_encoding ~* 'chunked') {
return 444;
}
Conclusion
The HTTP request smuggling vulnerability in Node.js poses significant risks to applications using affected versions. It is crucial to update to the patched versions to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for nodejs →
FAQ
CVE-2019-15605 is a critical vulnerability in Node.js that allows HTTP request smuggling due to improper handling of transfer-encoding headers.
The vulnerability affects Node.js versions 10, 12, and 13.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, data corruption, and execution of arbitrary code.
You can use Vulert, which monitors open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Implement a workaround by configuring your web server to reject requests with malformed transfer-encoding headers until you can update the package.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
