UnratedFix available
February 2020 Security Releases
Node.js released security updates for all active release lines, addressing HTTP request smuggling, HTTP header whitespace handling, and a TLS server crash, along with stricter HTTP parsing.
Announced Group revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Updates are now available for all active Node.js release lines for the following issues.
Node.js
Node.js v10.19.0 (LTS)
- Affected versions
- 10.x
All supported versions (10.x, 12.x, and 13.x) of Node.js are vulnerable.
12.xAll supported versions (10.x, 12.x, and 13.x) of Node.js are vulnerable.
13.xAll supported versions (10.x, 12.x, and 13.x) of Node.js are vulnerable.
- Fixed versions
- Node.js v10.19.0 (LTS)
Node.js v10.19.0 (LTS)
Node.js v12.15.0 (LTS)Node.js v12.15.0 (LTS)
Node.js v13.8.0 (Current)Node.js v13.8.0 (Current)
- Prerequisites
- Not stated in this extraction
- Related CVEs
- CVE-2019-15605
HTTP request smuggling using malformed Transfer-Encoding header (Critical) (CVE-2019-15605)
CVE-2019-15606HTTP header values do not have trailing OWS trimmed (High) (CVE-2019-15606)
CVE-2019-15604Remotely trigger an assertion on a TLS server with a malformed certificate string (High) (CVE-2019-15604)
Publisher severity
No explicit severity was extracted.
- Event
- #46500 · Revision 1
- Added to Heist Feed
- Publisher date