CVE-2019-15606

9.8 criticalEPSS 20%

Critical (9.8). EPSS 20% chance of exploitation in the next 30 days.

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

Severity

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 20% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2020-02-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

debian:debian_linux
nodejs:node.js
opensuse:leap
oracle:communications_cloud_native_core_network_function_cloud_native_environment
oracle:graalvm
redhat:enterprise_linux
redhat:enterprise_linux_eus