Node bursts of 13.8.0 , 12.15.0 and 10.19.0 three security release that fixes several vulnerabilities:
- 2019-15606-CVE: HTTP header value is not trim trailing OWS.
- CVE-2019-15605: use of exceptions Transfer-Encoding header initiate HTTP requests.
- 2019-15604-CVE : using a remote trigger abnormal certificate string assertion on the TLS server.
Meanwhile, HTTP parsing now more stringent, and therefore safer. However, because this may cause interoperability issues with certain inconsistent implementation of HTTP, so you can use --insecure-http-parser command line flag or insecureHTTPParser http option to disable strict inspection. Avoid using insecure HTTP parser.
For more details, see the instructions for each version update.