ALPINE-CVE-2019-15606
Advisory lineage Upstream: 1 Downstream: 0
Upstream
Published: 07 Feb 2020, 15:15
Last modified:03 Dec 2025, 22:44
Vulnerability Summary
Overall Risk (default)
high
70/100 CVSS Score
9.8 CRITICAL
3.1 (osv_alpine)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
07 Feb 2020, 15:15
Published
Vulnerability first disclosed
03 Dec 2025, 22:44
Last Modified
Vulnerability information updated
Description
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
CVSS Metrics
- v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Systems
- alpine•nodejs
< 10.19.0-r0 | < 12.15.0-r0 | < 12.15.0-r0 | < 12.15.0-r0 | < 12.15.0-r0 | < 12.15.0-r0 | < 12.15.0-r0 | < 12.15.0-r0 | < 12.15.0-r0 | < 12.15.0-r0 | < 12.15.0-r0 | < 12.15.0-r0 | < 12.15.0-r0 | < 12.15.0-r0 | < 10.19.0-r0