CVE-2019-15605 HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Description

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Affected products and versions

Product	Affected versions	Fixed in
Node 13.0	13.0 → < 13.8.0	13.8.0
Node 12.0	12.0 → < 12.15.0	12.15.0
Node 11.0	11.0 → latest	No fix stated
Node 10.0	10.0 → < 10.19.0	10.19.0
Node 9.0	9.0 → latest	No fix stated
Node 8.0	8.0 → latest	No fix stated
Node 7.0	7.0 → latest	No fix stated
Node 6.0	6.0 → latest	No fix stated
Node 5.0	5.0 → latest	No fix stated

Show the other branch Hide the other branch

Product	Affected versions	Fixed in
Node 4.0	4.0 → latest	No fix stated

Other CVEs of Node

The 129 CVEs of Node →

CVE-2026-106073 A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read… 3.3 Low CVE-2026-106074 A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,… 4.8 Medium CVE-2026-106072 A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when… 6.7 Medium CVE-2026-105481 A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before… 6.5 Medium