CVE-2017-16026: Remote Memory Exposure in request
Summary
CVE-2017-16026: Remote Memory Exposure in request. Affects request across 2 version ranges.
>= 2.2.6, < 2.68.0
>= 2.49.0, < 2.68.0
Fixed in 2.68.0. How to fix ↓
Also tracked for
- node-request · Debian:11
The same CVE-2017-16026 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'request' package is an open-source library for making HTTP requests in Node.js. It provides an easy-to-use interface for sending HTTP/HTTPS requests and handling responses. The package is widely used in various Node.js applications and is a popular choice for developers due to its simplicity and versatility. However, certain versions of the 'request' package are vulnerable to a remote memory exposure issue.
Vulnerability Detail
Affected versions of the 'request' package suffer from a vulnerability that can lead to the disclosure of local system memory to remote systems. This vulnerability occurs when a multipart request is made, and the type of the 'body' parameter is set to 'number'. In such cases, a buffer of the specified size is allocated and sent to the remote server as the request body. An attacker can exploit this vulnerability to obtain sensitive information from the server's memory, potentially leading to further attacks or unauthorized access.
How To Fix
Latest published version: 2.88.2 as of 22 Oct 2026
npm install request@2.88.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.68.0
This is the first release that contains the fix.
npm install request@2.68.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the 'request' package is not immediately feasible, a possible workaround is to avoid using the 'number' type for the 'body' parameter in multipart requests. Instead, use a different data type or ensure that the 'body' parameter is properly validated and sanitized before being used in the request.
Conclusion
In conclusion, the 'request' package is vulnerable to a remote memory exposure issue in certain versions. It is crucial for developers to update their dependencies to a non-vulnerable version of the package, specifically version 2.68.0 or later. This will help protect against potential attacks that exploit this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for request →
FAQ
This vulnerability can potentially expose sensitive information from the server's memory to remote attackers. Depending on the nature of the information, this can lead to further attacks or unauthorized access.
Versions of the 'request' package prior to 2.68.0 are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of writing. However, it is still important to update the package to prevent potential attacks.
The recommended mitigation is to update the 'request' package to a non-vulnerable version. If immediate update is not possible, developers can implement proper input validation and sanitization for the 'body' parameter in multipart requests.
You can find more information about this vulnerability, including the technical details and the fix, in the GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/11/GHSA-7xfp-9c55-5vqj/GHSA-7xfp-9c55-5vqj.json
References
Related vulnerabilities
Recent vulnerabilities recorded for request.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.