Skip to content
Fencer Intel
medium 5.9

CVE-2017-16026 json

Remote Memory Exposure in request

published 8y ago modified 4mo ago also GHSA-7xfp-9c55-5vqj , EUVD-2018-0736

cvss
5.9
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.6%
EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request >=2.2.6 <2.47.0 || >2.51.0 <=2.67.0.

Patch / fix

  • npm request 2.68.0
  • request_project request 2.47.0
  • node-request Debian 12 2.88.1-1

debian advisories DEBIAN-CVE-2017-16026

Is CVE-2017-16026 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-16026 updated cvss 4.3

nodejs-request: Remote Memory Exposure when a multipart request is made

  • Red Hat Enterprise Linux 8 nodejs-request
    affected: no fix planned “Will not fix”
  • Red Hat Mobile Application Platform 4 nodejs-request Red Hat OpenShift Enterprise 3 nodejs-request Red Hat Software Collections rh-nodejs6-nodejs-request
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.58% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/request/request/pull/2018 referenced PoC, tagged "exploit" by a source, unverified
  • nodesecurity.io https://nodesecurity.io/advisories/309 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/request/request/issues/1904 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 7.1 AV:N/AC:M/Au:N/C:C/I:N/A:N
GitHub 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
npm request
>=2.49.0, <2.68.0
>=2.2.6, <2.68.0
2.68.0

Affected products

  • HackerOne request node module

Classification

Weakness
  • CWE-201 Insertion of Sensitive Information Into Sent Data
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.