CVE-2017-16026

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request >=2.2.6 <2.47.0 || >2.51.0 <=2.67.0.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-201 CWE-20

Affected software

Vendor	Product	Versions
HackerOne	request node module	>=2.2.6 <2.47.0 \|\| >2.51.0 <=2.67.0

References

https://github.com/request/request/issues/1904Exploit, Issue Tracking, Third Party Advisory
https://github.com/request/request/pull/2018Exploit, Issue Tracking, Third Party Advisory
https://nodesecurity.io/advisories/309Exploit, Third Party Advisory
https://github.com/request/request/issues/1904Exploit, Issue Tracking, Third Party Advisory
https://github.com/request/request/pull/2018Exploit, Issue Tracking, Third Party Advisory
https://nodesecurity.io/advisories/309Exploit, Third Party Advisory

Timeline

Published: Jun 4, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-160285.3react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-CVE-2017-160297.5hostr is a simple web server that serves up the contents of the current directory. There is a directory traversal vulnerability in hostr 2.3 CVE-2017-160307.5Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own heade CVE-2017-160317.5Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Ma CVE-2017-160358.1The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from ap CVE-2017-160367.5`badjs-sourcemap-server` receives files sent by `badjs-sourcemap`. `badjs-sourcemap-server` is vulnerable to a directory traversal issue, gi CVE-2017-160377.5`gomeplus-h5-proxy` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by placing '../' in th CVE-2017-160387.5`f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" CVE-2017-160397.5`hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by pl CVE-2017-16045.4IBM Maximo Anywhere 7.5 and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in CVE-2017-160408.1gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM atta CVE-2017-160415.9ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks.