{"id":"CVE-2023-28155","aliases":["AZL-25664","AZL-43444","AZL-44241","CLSA-2026-1773965914","CLSA-2026-1775003197","CLSA-2026-1775003222","CLSA-2026-1776991061","CLSA-2026-1776991070","CLSA-2026-1788862348","CLSA-2026-1792476236","CLSA-2026-1792490434","CLSA-2026-1793208346","CLSA-2026-1793308813","CLSA-2026-1793309078","CLSA-2026-1793311310","DEBIAN-CVE-2023-28155","EUVD-2023-1068","GHSA-p8p7-x288-28g6","ROOT-APP-NPM-CVE-2023-28155","UBUNTU-CVE-2023-28155"],"status":"published","title":"Server-Side Request Forgery in Request","description":"The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00719,"percentile":0.5417,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2023-03-16T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"@cypress/request","fixed_in":["3.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"reaper","fixed_in":["3.1.1-5"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@cypress/request","fixed_in":["2.88.12-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"request","fixed_in":["2.88.0-tuxcare.1","2.88.2-tuxcare.2","2.75.0-tuxcare.1","2.81.0-tuxcare.1","2.65.0-tuxcare.2","2.87.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/request","fixed_in":["2.88.2-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"request","fixed_in":["2.88.2-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.88.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@cypress/request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.88.12"},{"fixed":"3.0.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"reaper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@cypress/request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.88.12-tuxcare.0"},{"fixed":"2.88.12-tuxcare.1"}]}],"versions":["2.88.12"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.88.0-tuxcare.0"},{"fixed":"2.88.0-tuxcare.1"}]}],"versions":["2.88.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.88.2-tuxcare.0"},{"fixed":"2.88.2-tuxcare.2"}]}],"versions":["2.88.2","2.88.2-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.75.0-tuxcare.0"},{"fixed":"2.75.0-tuxcare.1"}]}],"versions":["2.75.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.81.0-tuxcare.0"},{"fixed":"2.81.0-tuxcare.1"}]}],"versions":["2.81.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.65.0-tuxcare.0"},{"fixed":"2.65.0-tuxcare.2"}]}],"versions":["2.65.0","2.65.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0-tuxcare.0"},{"fixed":"2.37.0-tuxcare.1"}]}],"versions":["2.37.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.40.0-tuxcare.0"},{"fixed":"2.40.0-tuxcare.1"}]}],"versions":["2.40.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.87.0-tuxcare.0"},{"fixed":"2.87.0-tuxcare.1"}]}],"versions":["2.87.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.36.0-tuxcare.0"},{"fixed":"2.36.0-tuxcare.1"}]}],"versions":["2.36.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.57.0-tuxcare.0"},{"fixed":"2.57.0-tuxcare.1"}]}],"versions":["2.57.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.67.0-tuxcare.0"},{"fixed":"2.67.0-tuxcare.1"}]}],"versions":["2.67.0"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.88.1-6"]},{"source":"osv","ecosystem":"npm","package":"request","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2.88.2"}]}]},{"source":"osv","ecosystem":"npm","package":"@cypress/request","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.88.2-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.88.2-aikido.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"node-request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.153-1","2.26.1-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.26.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.26.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.88.1-2","2.88.1-3ubuntu1","2.88.1-4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.88.1-5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-request","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.88.1-6"]}],"products":[{"vendor":"request_project","product":"request"}],"references":[{"url":"https://github.com/request/request/issues/3442","tags":["x_transferred","Exploit","Issue Tracking","Patch","Technical Description","Vendor Advisory","report","web"]},{"url":"https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf","tags":["x_transferred","Exploit","Patch","Technical Description","Third Party Advisory","web","report"]},{"url":"https://github.com/request/request/pull/3444","tags":["x_transferred","Patch","fix","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20230413-0007/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28155","tags":["web","advisory"]},{"url":"https://github.com/github/advisory-database/pull/2500","tags":["web"]},{"url":"https://github.com/cypress-io/request/blob/master/lib/redirect.js#L116","tags":["web"]},{"url":"https://github.com/request/request/blob/master/lib/redirect.js#L111","tags":["web"]},{"url":"https://github.com/cypress-io/request/pull/28","tags":["web"]},{"url":"https://github.com/cypress-io/request/commit/c5bcf21d40fb61feaff21a0e5a2b3934a440024f","tags":["web"]},{"url":"https://github.com/cypress-io/request/releases/tag/v3.0.0","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20230413-0007","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p8p7-x288-28g6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28155.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-28155","tags":["advisory"]},{"url":"https://github.com/request/request","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-28155","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28155","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-28155","description":"The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2023-03-16T00:00:00Z","modified":"2024-08-02T12:30:24.515Z","updated_at":"2026-11-02T14:35:32.752775Z"}],"euvd":[{"id":"EUVD-2023-1068","description":"The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2023-03-16T00:00:00Z","modified":"2024-08-02T12:30:24Z","updated_at":"2026-11-03T03:50:06.256765Z"}],"ghsa":[{"id":"GHSA-p8p7-x288-28g6","title":"Server-Side Request Forgery in Request","description":"The `request` package through 2.88.2 for Node.js and the `@cypress/request` package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).\n\nNOTE: The `request` package is no longer supported by the maintainer.","status":"published","published":"2023-03-16T15:30:19Z","modified":"2024-03-21T17:47:21Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:37:41.821668Z"}],"nvd":[{"id":"CVE-2023-28155","description":"The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2023-03-16T15:15:11.107Z","modified":"2026-06-17T05:46:59.167Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:07:49.031498Z"}],"osv":[{"id":"AZL-25664","title":"CVE-2023-28155 affecting package reaper for versions less than 3.1.1-5","description":"The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2023-03-16T15:15:11Z","modified":"2026-04-21T04:23:11.157606Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-43444","title":"CVE-2023-28155 affecting package js-jquery 3.5.0-4","description":"The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2023-03-16T15:15:11Z","modified":"2026-04-21T04:30:59.725546Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-44241","title":"CVE-2023-28155 affecting package js-jquery 3.5.0-4","description":"The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2023-03-16T15:15:11Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"DEBIAN-CVE-2023-28155","description":"The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2023-03-16T15:15:11.107Z","modified":"2026-10-26T18:00:48.528629399Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"GHSA-p8p7-x288-28g6","title":"Server-Side Request Forgery in Request","description":"The `request` package through 2.88.2 for Node.js and the `@cypress/request` package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).\n\nNOTE: The `request` package is no longer supported by the maintainer.","status":"published","published":"2023-03-16T15:30:19Z","modified":"2026-09-10T03:49:52.915755034Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"ROOT-APP-NPM-CVE-2023-28155","title":"CVE-2023-28155 in @rootio/request - Patched by Root","description":"Root has patched CVE-2023-28155 in the @rootio/request package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-24T11:54:34Z","modified":"2026-06-24T14:04:22.118863603Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"UBUNTU-CVE-2023-28155","description":"The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2023-03-16T15:15:00Z","modified":"2026-01-20T17:37:14.728511Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"CLSA-2026-1773965914","title":"TuxCare security update for @cypress/request (1 CVE)","description":"TuxCare rebuilt @cypress/request to address 1 CVE. Fixed in 2.88.12-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:45:08.984272983Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1775003197","title":"TuxCare security update for request (1 CVE)","description":"TuxCare rebuilt request to address 1 CVE. Fixed in 2.88.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:19Z","modified":"2026-10-15T09:47:48.920088845Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775003222","title":"TuxCare security update for request (1 CVE)","description":"TuxCare rebuilt request to address 1 CVE. Fixed in 2.88.2-tuxcare.2.","status":"published","published":"2026-08-04T14:52:19Z","modified":"2026-10-15T09:47:49.230544769Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1776991061","title":"TuxCare security update for request (1 CVE)","description":"TuxCare rebuilt request to address 1 CVE. Fixed in 2.75.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:28Z","modified":"2026-10-15T09:47:49.991398446Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1776991070","title":"TuxCare security update for request (1 CVE)","description":"TuxCare rebuilt request to address 1 CVE. Fixed in 2.81.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:28Z","modified":"2026-10-15T09:47:50.142265481Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1788862348","title":"TuxCare security update for request (1 CVE)","description":"TuxCare rebuilt request to address 1 CVE. Fixed in 2.65.0-tuxcare.2.","status":"published","published":"2026-09-08T10:12:28Z","modified":"2026-10-15T09:48:03.104318886Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1792476236","title":"TuxCare security update for request (2 CVEs)","description":"TuxCare rebuilt request to address 2 CVEs. Fixed in 2.37.0-tuxcare.1.","status":"published","published":"2026-10-20T06:03:56Z","modified":"2026-10-20T07:15:14.570947456Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792490434","title":"TuxCare security update for request (2 CVEs)","description":"TuxCare rebuilt request to address 2 CVEs. Fixed in 2.40.0-tuxcare.1.","status":"published","published":"2026-10-20T10:00:34Z","modified":"2026-10-20T13:45:13.457728217Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793208346","title":"TuxCare security update for request (1 CVE)","description":"TuxCare rebuilt request to address 1 CVE. Fixed in 2.87.0-tuxcare.1.","status":"published","published":"2026-10-28T17:25:46Z","modified":"2026-10-28T19:45:12.897685077Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793308813","title":"TuxCare security update for request (2 CVEs)","description":"TuxCare rebuilt request to address 2 CVEs. Fixed in 2.36.0-tuxcare.1.","status":"published","published":"2026-10-29T22:20:14Z","modified":"2026-10-30T02:15:07.700114734Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793309078","title":"TuxCare security update for request (2 CVEs)","description":"TuxCare rebuilt request to address 2 CVEs. Fixed in 2.57.0-tuxcare.1.","status":"published","published":"2026-10-29T22:24:39Z","modified":"2026-10-30T02:15:05.13001776Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793311310","title":"TuxCare security update for request (2 CVEs)","description":"TuxCare rebuilt request to address 2 CVEs. Fixed in 2.67.0-tuxcare.1.","status":"published","published":"2026-10-29T23:01:51Z","modified":"2026-10-30T02:15:06.283790739Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CVE-2023-28155","description":"The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2023-03-16T00:00:00Z","modified":"2026-10-28T02:30:24.056022672Z","updated_at":"2026-11-02T15:44:31.468318Z"}]}}