CVE-2019-15605

CVE-2019-15605

Vendor Nodejs
Product Node
Weakness CWE-444
Published February 7, 2020
Last update April 30, 2025
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Key dates

02Disclosure timeline

February 7, 2020 CVE published
April 30, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-31137 Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers CVE-2023-46137 twisted.web has disordered HTTP pipeline response CVE-2026-48710 Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks CVE-2026-58055 nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length CVE-2021-21299 Multiple Transfer-Encoding headers misinterprets request payload