CVE-2023-28155
Server-Side Request Forgery in Request
The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Record
CVE-2023-28155- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
CVE List No score
The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Record
CVE-2023-28155- Updated
- 2026-11-02
EUVDEUVD-2023-1068 No score
The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Record
EUVD-2023-1068- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p8p7-x288-28g6
Server-Side Request Forgery in Request
The request package through 2.88.2 for Node.js and the @cypress/request package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).
NOTE: The request package is no longer supported by the maintainer.
- Record
GHSA-p8p7-x288-28g6- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVAZL-25664
CVE-2023-28155 affecting package reaper for versions less than 3.1.1-5
The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Record
AZL-25664- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVAZL-43444
CVE-2023-28155 affecting package js-jquery 3.5.0-4
The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Record
AZL-43444- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 18 moreShow less
OSVAZL-44241
CVE-2023-28155 affecting package js-jquery 3.5.0-4
The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Record
AZL-44241- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-05
OSVDEBIAN-CVE-2023-28155
The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Record
DEBIAN-CVE-2023-28155- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-p8p7-x288-28g6
Server-Side Request Forgery in Request
The request package through 2.88.2 for Node.js and the @cypress/request package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).
NOTE: The request package is no longer supported by the maintainer.
- Record
GHSA-p8p7-x288-28g6- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2023-28155
CVE-2023-28155 in @rootio/request - Patched by Root
Root has patched CVE-2023-28155 in the @rootio/request package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2023-28155- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-28155
The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Record
UBUNTU-CVE-2023-28155- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1773965914 No score
TuxCare security update for @cypress/request (1 CVE)
TuxCare rebuilt @cypress/request to address 1 CVE. Fixed in 2.88.12-tuxcare.1.
- Record
CLSA-2026-1773965914- Updated
- 2026-11-02
OSVCLSA-2026-1775003197 No score
TuxCare security update for request (1 CVE)
TuxCare rebuilt request to address 1 CVE. Fixed in 2.88.0-tuxcare.1.
- Record
CLSA-2026-1775003197- Updated
- 2026-11-02
OSVCLSA-2026-1775003222 No score
TuxCare security update for request (1 CVE)
TuxCare rebuilt request to address 1 CVE. Fixed in 2.88.2-tuxcare.2.
- Record
CLSA-2026-1775003222- Updated
- 2026-11-02
OSVCLSA-2026-1776991061 No score
TuxCare security update for request (1 CVE)
TuxCare rebuilt request to address 1 CVE. Fixed in 2.75.0-tuxcare.1.
- Record
CLSA-2026-1776991061- Updated
- 2026-11-02
OSVCLSA-2026-1776991070 No score
TuxCare security update for request (1 CVE)
TuxCare rebuilt request to address 1 CVE. Fixed in 2.81.0-tuxcare.1.
- Record
CLSA-2026-1776991070- Updated
- 2026-11-02
OSVCLSA-2026-1788862348 No score
TuxCare security update for request (1 CVE)
TuxCare rebuilt request to address 1 CVE. Fixed in 2.65.0-tuxcare.2.
- Record
CLSA-2026-1788862348- Updated
- 2026-11-02
OSVCLSA-2026-1792476236 No score
TuxCare security update for request (2 CVEs)
TuxCare rebuilt request to address 2 CVEs. Fixed in 2.37.0-tuxcare.1.
- Record
CLSA-2026-1792476236- Updated
- 2026-11-02
OSVCLSA-2026-1792490434 No score
TuxCare security update for request (2 CVEs)
TuxCare rebuilt request to address 2 CVEs. Fixed in 2.40.0-tuxcare.1.
- Record
CLSA-2026-1792490434- Updated
- 2026-11-02
OSVCLSA-2026-1793208346 No score
TuxCare security update for request (1 CVE)
TuxCare rebuilt request to address 1 CVE. Fixed in 2.87.0-tuxcare.1.
- Record
CLSA-2026-1793208346- Updated
- 2026-11-02
OSVCLSA-2026-1793308813 No score
TuxCare security update for request (2 CVEs)
TuxCare rebuilt request to address 2 CVEs. Fixed in 2.36.0-tuxcare.1.
- Record
CLSA-2026-1793308813- Updated
- 2026-11-02
OSVCLSA-2026-1793309078 No score
TuxCare security update for request (2 CVEs)
TuxCare rebuilt request to address 2 CVEs. Fixed in 2.57.0-tuxcare.1.
- Record
CLSA-2026-1793309078- Updated
- 2026-11-02
OSVCLSA-2026-1793311310 No score
TuxCare security update for request (2 CVEs)
TuxCare rebuilt request to address 2 CVEs. Fixed in 2.67.0-tuxcare.1.
- Record
CLSA-2026-1793311310- Updated
- 2026-11-02
OSV No score
The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Record
CVE-2023-28155- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
requestnpm |
through 2.88.2 | None known |
@cypress/requestnpm |
through 2.88.12 | 3.0.0 |
reaperAzure Linux:2 |
before 3.1.1-5 | 3.1.1-5 |
js-jqueryAzure Linux:2 |
through 3.5.0-4 | None known |
js-jqueryAzure Linux:3 |
through 3.5.0-4 | None known |
@cypress/requestTuxCare:npm |
2.88.12-tuxcare.0 up to 2.88.12-tuxcare.1, plus listed versions 2.88.12 |
2.88.12-tuxcare.1 |
requestTuxCare:npm |
2.88.0-tuxcare.0 up to 2.88.0-tuxcare.1, plus listed versions 2.88.0 |
2.88.0-tuxcare.1 |
requestTuxCare:npm |
2.88.2-tuxcare.0 up to 2.88.2-tuxcare.2, plus listed versions 2.88.22.88.2-tuxcare.1 |
2.88.2-tuxcare.2 |
requestTuxCare:npm |
2.75.0-tuxcare.0 up to 2.75.0-tuxcare.1, plus listed versions 2.75.0 |
2.75.0-tuxcare.1 |
requestTuxCare:npm |
2.81.0-tuxcare.0 up to 2.81.0-tuxcare.1, plus listed versions 2.81.0 |
2.81.0-tuxcare.1 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
requestTuxCare:npm |
2.65.0-tuxcare.0 up to 2.65.0-tuxcare.2, plus listed versions 2.65.02.65.0-tuxcare.1 |
2.65.0-tuxcare.2 |
requestTuxCare:npm From an advisory covering 2 CVEs |
2.37.0-tuxcare.0 up to 2.37.0-tuxcare.1, plus listed versions 2.37.0 |
2.37.0-tuxcare.1 |
requestTuxCare:npm From an advisory covering 2 CVEs |
2.40.0-tuxcare.0 up to 2.40.0-tuxcare.1, plus listed versions 2.40.0 |
2.40.0-tuxcare.1 |
requestTuxCare:npm |
2.87.0-tuxcare.0 up to 2.87.0-tuxcare.1, plus listed versions 2.87.0 |
2.87.0-tuxcare.1 |
requestTuxCare:npm From an advisory covering 2 CVEs |
2.36.0-tuxcare.0 up to 2.36.0-tuxcare.1, plus listed versions 2.36.0 |
2.36.0-tuxcare.1 |
requestTuxCare:npm From an advisory covering 2 CVEs |
2.57.0-tuxcare.0 up to 2.57.0-tuxcare.1, plus listed versions 2.57.0 |
2.57.0-tuxcare.1 |
requestTuxCare:npm From an advisory covering 2 CVEs |
2.67.0-tuxcare.0 up to 2.67.0-tuxcare.1, plus listed versions 2.67.0 |
2.67.0-tuxcare.1 |
node-requestDebian:12 |
All versions, plus listed versions 2.88.1-6 |
None known |
@cypress/requestnpm |
before 3.0.0 | 3.0.0 |
@rootio/requestRoot:npm |
before 2.88.2-root.io.1 | 2.88.2-root.io.1 |
requestRoot:npm |
before 2.88.2-aikido.1 | 2.88.2-aikido.1 |
node-requestUbuntu:14.04:LTS |
All versions, plus listed versions 2.9.153-12.26.1-1 |
None known |
node-requestUbuntu:16.04:LTS |
All versions, plus listed versions 2.26.1-1 |
None known |
node-requestUbuntu:18.04:LTS |
All versions, plus listed versions 2.26.1-1 |
None known |
node-requestUbuntu:20.04:LTS |
All versions, plus listed versions 2.88.1-22.88.1-3ubuntu12.88.1-4 |
None known |
node-requestUbuntu:22.04:LTS |
All versions, plus listed versions 2.88.1-5 |
None known |
node-requestUbuntu:24.04:LTS |
All versions, plus listed versions 2.88.1-6 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-28155 is a medium vulnerability (CVSS 6.1) in Request Project Request, published March 16, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in @cypress/request 3.0.0.
References
github.com/request/request/issues/3442
doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf
security.netapp.com/advisory/ntap-20230413-0007
nvd.nist.gov/vuln/detail/CVE-2023-28155
Show 11 moreShow less
security-tracker.debian.org/tracker/CVE-2023-28155
ubuntu.com/security/CVE-2023-28155
cve.org/CVERecord?id=CVE-2023-28155