CVE-2023-28155: Server-Side Request Forgery in Request

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-03-16 · updated 2026-06-17
Weakness: CWE-918

Description

The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Affected products

HackerOne request node module: through 2.88.1
Npm @Cypress/Request: before 3.0.0 — fixed in 3.0.0
Npm Request: through 2.88.2

How to fix

Upgrade to a fixed version: Npm @Cypress/Request 3.0.0. Check the vendor advisory for mitigations.

References

https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf
https://github.com/request/request/issues/3442
https://github.com/request/request/pull/3444
https://security.netapp.com/advisory/ntap-20230413-0007/
https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf
https://github.com/request/request/issues/3442
https://github.com/request/request/pull/3444
https://security.netapp.com/advisory/ntap-20230413-0007/

Get alerted when CVE-2023-28155 or the next vulnerability affects your stack