New releases of Node.js 13.8, 12.15, and 10.19 with vulnerability fixes.

Разработчики серверной JavaScript-платформы Node.js have published Corrective releases 13.8.0, 12.15.0, and 10.19.0 have addressed three vulnerabilities:

• CVE-2019-15606 — improper handling of optional whitespace characters (OWS) following the value in an HTTP header;
• CVE-2019-15605 — a potential HRS (HTTP Request Smuggling) attack, , rather than taking focus. interfering with the contents of other requests processed in the same stream between the frontend and backend) through a specially crafted HTTP header Transfer-Encoding;
• CVE-2019-15604 — remotely initiated crash of the TLS server through the transmission of an incorrect string in the certificate.

Additionally, the new releases have improved the security of the HTTP parser and implemented stricter parsing of HTTP request elements. This change may lead to compatibility issues with HTTP implementations that violate specification requirements. To disable strict checking mode, a setting for insecureHTTPParser and the command line option "—insecure-http-parser" is available.

Source: opennet.ru