CVE-2019-15605: Node.js HTTP request smuggling via malformed Transfer-Encoding

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCritical CVSS (9.8) and very high EPSS (99th percentile) on a widely deployed runtime, though not in KEV and requiring a proxy chain to exploit.

What it is

Node.js versions 10, 12 and 13 mishandle malformed Transfer-Encoding headers, allowing HTTP request smuggling. This lets an attacker desynchronize front-end and back-end HTTP parsing, so requests can be split or smuggled past intermediaries. It matters because Node.js is widely deployed as an origin or proxy component, and the flaw is remotely reachable without credentials.

Impact

An attacker can smuggle requests through an intermediary to reach the back-end server, potentially bypassing access controls, poisoning caches, or capturing other users' requests. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reachable over the network via HTTP requests carrying a malformed Transfer-Encoding header; the CVSS vector shows no privileges required and no user interaction. Exploitation depends on a front-end/back-end HTTP chain where parsing differs, which the record does not enumerate.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is 0.57132 (99th percentile), indicating high predicted likelihood of exploitation activity. References are vendor advisories, distro errata and a HackerOne report, with no public exploit tag.

What to do

• Upgrade Node.js to the fixed releases: 10.19.0, 12.15.0 or 13.8.0, or later.
• Apply the linked distro and vendor errata (Red Hat, Debian, Fedora, openSUSE, Oracle, Gentoo, NetApp) for packaged Node.js.
• Normalize and reject ambiguous or malformed Transfer-Encoding and Content-Length headers at the edge proxy.
• Ensure front-end and back-end HTTP parsers agree on request framing; avoid mixing Transfer-Encoding and Content-Length.
• Inventory Node.js instances and embedded runtimes (including GraalVM) to confirm patched versions.

Detection

• Inspect proxy and server logs for requests containing both Transfer-Encoding and Content-Length, or malformed Transfer-Encoding values.
• Alert on HTTP 400/501 responses clustered around header-parsing errors from a single source.
• Compare front-end and back-end request logs for framing mismatches or requests seen by one tier but not the other.
• Monitor for cache poisoning or unexpected response splitting patterns following suspicious header traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.