What’s Vulnerable › Vulnerabilities

CVE-2017-16026: Remote Memory Exposure in request

• Severity: medium (CVSS 5.9 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-06-04 · updated 2026-06-17
• Weakness: CWE-201

Description

Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request >=2.2.6 <2.47.0 || >2.51.0 <=2.67.0.

Affected products

• HackerOne request node module: from 2.2.6 before 2.47.0; from 2.51.0 (excl.) through 2.67.0 — fixed in 2.47.0
• Npm Request: from 2.49.0 before 2.68.0; from 2.2.6 before 2.68.0 — fixed in 2.68.0

How to fix

Upgrade to a fixed version: HackerOne request node module 2.47.0; Npm Request 2.68.0. Check the vendor advisory for mitigations.

References

• https://github.com/request/request/issues/1904
• https://github.com/request/request/pull/2018
• https://nodesecurity.io/advisories/309
• https://github.com/request/request/issues/1904
• https://github.com/request/request/pull/2018
• https://nodesecurity.io/advisories/309

Get alerted when CVE-2017-16026 or the next vulnerability affects your stack