CVE-2017-16026 Remote Memory Exposure in request
An attacker can read non-zero memory contents by sending a multipart request with a numeric body type in the Request library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-16026?
CVE-2017-16026 is a medium-severity vulnerability in HackerOne request node module, published on 4 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request >=2.2.6 <2.47.0 || >2.51.0 <=2.67.0.
Which versions are affected by CVE-2017-16026?
4 open source packages ship an affected version, including request. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
request npm | From 2.2.6 | 2.68.0 |
request npm | From 2.2.6 | 2.68.0 |
request npm | From 2.49.0 | 2.68.0 |
request npm | From 2.49.0 | 2.68.0 |
Products include Request Project Request.
How do I fix CVE-2017-16026?
Upgrade request to 2.68.0 or later.
Is CVE-2017-16026 being exploited?
There is no known exploitation of CVE-2017-16026 in the wild and no public exploit code.
Other vulnerabilities in HackerOne request node module
Sources
Also known as CLSA-2026-1785291220, DEBIAN-CVE-2017-16026, GHSA-7xfp-9c55-5vqj.