{"id":"CVE-2017-16026","aliases":["CLSA-2026-1785291220","CLSA-2026-1792476236","CLSA-2026-1792490434","CLSA-2026-1793308813","CLSA-2026-1793309078","CLSA-2026-1793311310","DEBIAN-CVE-2017-16026","EUVD-2018-0736","GHSA-7xfp-9c55-5vqj"],"status":"published","title":"Remote Memory Exposure in request","description":"Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request \u003e=2.2.6 \u003c2.47.0 || \u003e2.51.0 \u003c=2.67.0.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02584,"percentile":0.85346,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-201"],"published":"2018-06-04T19:00:00Z","modified":"2026-10-30T02:15:07Z","fixes":[{"ecosystem":"npm","package":"request","fixed_in":["2.68.0","2.47.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"request","fixed_in":["2.65.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-request","fixed_in":["2.88.1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.49.0"},{"fixed":"2.68.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.6"},{"fixed":"2.47.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.65.0-tuxcare.0"},{"fixed":"2.65.0-tuxcare.1"}]}],"versions":["2.65.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0-tuxcare.0"},{"fixed":"2.37.0-tuxcare.1"}]}],"versions":["2.37.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.40.0-tuxcare.0"},{"fixed":"2.40.0-tuxcare.1"}]}],"versions":["2.40.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.36.0-tuxcare.0"},{"fixed":"2.36.0-tuxcare.1"}]}],"versions":["2.36.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.57.0-tuxcare.0"},{"fixed":"2.57.0-tuxcare.1"}]}],"versions":["2.57.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.67.0-tuxcare.0"},{"fixed":"2.67.0-tuxcare.1"}]}],"versions":["2.67.0"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.88.1-1"}]}]},{"source":"osv","ecosystem":"npm","package":"request","ranges":[{"type":"SEMVER","events":[{"introduced":"2.49.0"},{"fixed":"2.68.0"}]}]},{"source":"osv","ecosystem":"npm","package":"request","ranges":[{"type":"SEMVER","events":[{"introduced":"2.2.6"},{"fixed":"2.68.0"}]}]}],"products":[{"vendor":"hackerone","product":"request node module"},{"vendor":"request_project","product":"request"}],"references":[{"url":"https://github.com/request/request/pull/2018","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nodesecurity.io/advisories/309","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/request/request/issues/1904","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16026","tags":["advisory"]},{"url":"https://github.com/request/request/pull/2022","tags":["web"]},{"url":"https://github.com/request/request/commit/29d81814bc16bc79cb112b4face8be6fc00061dd","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7xfp-9c55-5vqj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-16026","tags":["advisory"]},{"url":"https://github.com/request/request","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-16026","description":"Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request \u003e=2.2.6 \u003c2.47.0 || \u003e2.51.0 \u003c=2.67.0.","status":"published","published":"2018-06-04T19:00:00Z","modified":"2024-09-16T17:28:08.484Z","cwes":["CWE-201"],"updated_at":"2026-11-02T14:33:21.453505Z"}],"euvd":[{"id":"EUVD-2018-0736","description":"Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request \u003e=2.2.6 \u003c2.47.0 || \u003e2.51.0 \u003c=2.67.0.","status":"published","published":"2018-06-04T19:00:00Z","modified":"2024-09-16T17:28:08Z","updated_at":"2026-11-03T00:55:41.925187Z"}],"ghsa":[{"id":"GHSA-7xfp-9c55-5vqj","title":"Remote Memory Exposure in request","description":"Affected versions of `request` will disclose local system memory to remote systems in certain circumstances. When a multipart request is made, and the type of `body` is `number`, then a buffer of that size will be allocated and sent to the remote server as the body.\n\n## Proof of Concept\n\n```js\nvar request = require('request');\nvar http = require('http');\n\nvar serveFunction = function (req, res){\n\treq.on('data', function (data) {\n            console.log(data)\n        });\n\tres.end();\n};\nvar server = http.createServer(serveFunction);\nserver.listen(8000);\n\nrequest({\n\tmethod: \"POST\",\n\turi: 'http://localhost:8000',\n\tmultipart: [{body:500}]\n},function(err,res,body){});\n```\n\n\n## Recommendation\n\nUpdate to version 2.68.0 or later","status":"published","published":"2018-11-09T17:44:01Z","modified":"2023-09-12T18:48:47Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T14:37:04.447845Z"}],"nvd":[{"id":"CVE-2017-16026","description":"Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request \u003e=2.2.6 \u003c2.47.0 || \u003e2.51.0 \u003c=2.67.0.","status":"published","published":"2018-06-04T19:29:01.537Z","modified":"2026-06-17T01:08:39.843Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":7.1,"vector":"AV:N/AC:M/Au:N/C:C/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-201","CWE-20"],"updated_at":"2026-11-02T14:04:17.638656Z"}],"osv":[{"id":"CVE-2017-16026","description":"Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request \u003e=2.2.6 \u003c2.47.0 || \u003e2.51.0 \u003c=2.67.0.","status":"published","published":"2018-06-04T19:29:01.537Z","modified":"2026-10-20T10:48:16.47345225Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"DEBIAN-CVE-2017-16026","description":"Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request \u003e=2.2.6 \u003c2.47.0 || \u003e2.51.0 \u003c=2.67.0.","status":"published","published":"2018-06-04T19:29:01.537Z","modified":"2026-09-01T20:03:45.318646546Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"GHSA-7xfp-9c55-5vqj","title":"Remote Memory Exposure in request","description":"Affected versions of `request` will disclose local system memory to remote systems in certain circumstances. When a multipart request is made, and the type of `body` is `number`, then a buffer of that size will be allocated and sent to the remote server as the body.\n\n## Proof of Concept\n\n```js\nvar request = require('request');\nvar http = require('http');\n\nvar serveFunction = function (req, res){\n\treq.on('data', function (data) {\n            console.log(data)\n        });\n\tres.end();\n};\nvar server = http.createServer(serveFunction);\nserver.listen(8000);\n\nrequest({\n\tmethod: \"POST\",\n\turi: 'http://localhost:8000',\n\tmultipart: [{body:500}]\n},function(err,res,body){});\n```\n\n\n## Recommendation\n\nUpdate to version 2.68.0 or later","status":"published","published":"2018-11-09T17:44:01Z","modified":"2023-11-08T03:59:00.437371Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"CLSA-2026-1785291220","title":"TuxCare security update for request (1 CVE)","description":"TuxCare rebuilt request to address 1 CVE. Fixed in 2.65.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T09:47:37.606890471Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1792476236","title":"TuxCare security update for request (2 CVEs)","description":"TuxCare rebuilt request to address 2 CVEs. Fixed in 2.37.0-tuxcare.1.","status":"published","published":"2026-10-20T06:03:56Z","modified":"2026-10-20T07:15:14.570947456Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792490434","title":"TuxCare security update for request (2 CVEs)","description":"TuxCare rebuilt request to address 2 CVEs. Fixed in 2.40.0-tuxcare.1.","status":"published","published":"2026-10-20T10:00:34Z","modified":"2026-10-20T13:45:13.457728217Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793308813","title":"TuxCare security update for request (2 CVEs)","description":"TuxCare rebuilt request to address 2 CVEs. Fixed in 2.36.0-tuxcare.1.","status":"published","published":"2026-10-29T22:20:14Z","modified":"2026-10-30T02:15:07.700114734Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793309078","title":"TuxCare security update for request (2 CVEs)","description":"TuxCare rebuilt request to address 2 CVEs. Fixed in 2.57.0-tuxcare.1.","status":"published","published":"2026-10-29T22:24:39Z","modified":"2026-10-30T02:15:05.13001776Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793311310","title":"TuxCare security update for request (2 CVEs)","description":"TuxCare rebuilt request to address 2 CVEs. Fixed in 2.67.0-tuxcare.1.","status":"published","published":"2026-10-29T23:01:51Z","modified":"2026-10-30T02:15:06.283790739Z","updated_at":"2026-11-02T15:43:55.669514Z"}]}}