Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

References

• https://nvd.nist.gov/vuln/detail/CVE-2019-15606
• https://hackerone.com/reports/730779
• https://access.redhat.com/errata/RHSA-2020:0573
• https://access.redhat.com/errata/RHSA-2020:0579
• https://access.redhat.com/errata/RHSA-2020:0597
• https://access.redhat.com/errata/RHSA-2020:0598
• https://access.redhat.com/errata/RHSA-2020:0602
• https://security.gentoo.org/glsa/202003-48
• https://www.debian.org/security/2020/dsa-4669
• https://www.oracle.com/security-alerts/cpuapr2020.html
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://nodejs.org/en/blog/release/v10.19.0
• https://nodejs.org/en/blog/release/v12.15.0
• https://nodejs.org/en/blog/release/v13.8.0
• https://nodejs.org/en/blog/vulnerability/february-2020-security-releases
• https://security.netapp.com/advisory/ntap-20200221-0004