PT-2018-6057 · Npm · Request

Github-Actionsbot · Published 2018-06-04 · Updated 2026-02-04 · CVE-2017-16026

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Request versions 2.2.6 through 2.46.9 Request versions 2.51.0 through 2.67.0

Description: The issue affects the Request library when a multipart request is made and the body type is a number. In such cases, a buffer of the specified size is allocated and sent to the remote server as the body, potentially disclosing local system memory to remote systems.

Recommendations: For Request versions 2.2.6 through 2.46.9, update to version 2.68.0 or later. For Request versions 2.51.0 through 2.67.0, update to version 2.68.0 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

CWE-201

Related Identifiers

CVE-2017-16026

GHSA-7XFP-9C55-5VQJ

Affected Products

Request

References · 12

• 🔥 https://github.com/request/request/pull/2018 · Exploit
• 🔥 https://github.com/request/request/issues/1904 · Exploit
• 🔥 https://nodesecurity.io/advisories/309 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-16026 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16026 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-16026 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7xfp-9c55-5vqj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16026 · Vendor Advisory
• https://github.com/request/request/pull/2022 · Note
• https://github.com/request/request · Note
• https://github.com/request/request/commit/29d81814bc16bc79cb112b4face8be6fc00061dd · Note
• https://t.me/aptreports/25683 · Telegram Post