peter bassill · operator
$ cve CVE-2019-15605 JSON

CVE-2019-15605

9.8
CRITICAL · CVSS 3.1 · EPSS 57.1% (pctl 99)

Patch early

EPSS 57.1% — above the 10% action threshold.

Description

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS57.13% — more likely to be exploited than 99% of all CVEs
WeaknessCWE-444
On CISA KEVno
Public exploitnone known
Published2020-02-07
Last modified2026-06-17

Affected (13)

VendorProduct
debiandebian linux
fedoraprojectfedora
nodejsnode.js
opensuseleap
oraclegraalvm
redhatenterprise linux
redhatenterprise linux desktop
redhatenterprise linux eus
redhatenterprise linux server
redhatenterprise linux server aus
redhatenterprise linux server tus
redhatenterprise linux workstation
redhatsoftware collections

References

→ the Explorer  ·  watch your stack  ·  NVD