Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2019-15605

Critical

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Published Feb 7, 2020 · Updated Aug 4, 2026 · Also known as ALPINE-CVE-2019-15605, DEBIAN-CVE-2019-15605, UBUNTU-CVE-2019-15605

Key Facts

Patch immediately
  • CVE-2019-15605 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Node.js (Nodejs), Graalvm (Oracle), Software Collections (Redhat) and 22 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
  • EPSS estimates a 57% probability of exploitation in the next 30 days.
  • Fixed versions are available, including http-parser 0:2.7.1-5.el7_6.1, http-parser 0:2.8.0-5.el8_1.2, http-parser 2.7.1-8.amzn2.2.
  • Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

57%

Higher than 99.0% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2019-15605 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Affected Products

199 affected entries in total
ProductAffected versionsFixed in
Node.jsNodejsSee advisory13.8.0
GraalvmOracle19.3.1, 20.0.0n/a
Software CollectionsRedhat1.0n/a
Debian LinuxDebian10.0n/a
FedoraFedoraproject30n/a
20 more affected products in the full CVE brief

Patched Releases

http-parser

0:2.7.1-5.el7_6.1, 0:2.8.0-5.el8_1.2, 2.7.1-8.amzn2.2, 2.7.1-8.el7_7.2, 2.8.0-5.el8_1.2, 2.9.3-1.2.amzn1, 2.9.4-2

http-parser-devel

2.7.1-8.amzn2.2, 2.7.1-8.el7_7.2, 2.9.3-1.2.amzn1

Node

10.19.0, 11.*, 12.15.0, 13.8.0, 4.*, 5.*, 6.*, 7.*, 8.*, 9.*

nodejs

1:10.19.0-1.module+el8.1.0+5552+3cab52c0, 1:12.16.1-1.module+el8.1.0+5548+c572d87b, 10.19.0-r0, 10.19.0~dfsg-1, 10.19.0~dfsg-3ubuntu1.1, 10.19.0~dfsg1-1, 12.15.0-r0, 13.8.0-1.ph3, 4.2.6~dfsg-1ubuntu4.2+esm2, 8.10.0~dfsg-2ubuntu0.4+esm2, NA

Node.js

10.19.0, 13.8.0

nodejs-current

13.11.0-r0

nodejs-devel

1:10.19.0-1.module+el8.1.0+5552+3cab52c0, 1:12.16.1-1.module+el8.1.0+5548+c572d87b

nodejs-docs

1:10.19.0-1.module+el8.1.0+5552+3cab52c0, 1:12.16.1-1.module+el8.1.0+5548+c572d87b

nodejs-nodemon

1.18.3-1.module_el8.3.0+2023+d2377ea3, 1.18.3-1.module+el8.1.0+5392+4d6b561f, 1.18.3-1.module+el8.1.0+5393+aaf413e3, 1.18.3-1.module+el8.3.0+101+f84c7154

nodejs-packaging

17-3.module_el8.4.0+2224+b07ac28e, 17-3.module+el8.1.0+5392+4d6b561f, 17-3.module+el8.1.0+5393+aaf413e3, 17-3.module+el8.3.0+101+f84c7154

nodejs:10

8000020200214110450.f8e95b4e

nodejs:12

8010020200220143053.c27ad7f8

nodejs10

10.19.0-1.18.1, 10.19.0-1.ph1

nodejs10-devel

10.19.0-1.18.1

nodejs10-docs

10.19.0-1.18.1

nodejs12

12.15.0-1.6.1

nodejs12-devel

12.15.0-1.6.1

nodejs12-docs

12.15.0-1.6.1

nodejs6

6.17.1-11.33.1

nodejs6-devel

6.17.1-11.33.1

nodejs6-docs

6.17.1-11.33.1

nodejs8

8.17.0-3.28.1, 8.17.0-lp151.2.12.1

nodejs8-devel

8.17.0-3.28.1, 8.17.0-lp151.2.12.1

nodejs8-docs

8.17.0-3.28.1, 8.17.0-lp151.2.12.1

npm

1:6.13.4-1.10.19.0.1.module+el8.1.0+5552+3cab52c0, 1:6.13.4-1.12.16.1.1.module+el8.1.0+5548+c572d87b

Timeline

  1. Publicly disclosed

    Feb 7, 2020

  2. Last updated

    Aug 4, 2026

Weakness Type

  • CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2019-15605 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo