GCVE - cpe:2.3:a:request_project:request:*:*:*:*:*:node.js:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:request_project:request:*:*:*:*:*:node.js:*:*

part: a version: * update: *

Vendor	Request Project (`df2a36d3-87a8-5f65-9ec2-ed1985c59180`)
Product	Request (`f01d64f3-9a3c-51bf-a722-82d7c684b96c`)
Edition	*
Language	*
Software edition	*
Target software	node.js
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-28155`	vulnerable	2026-06-08 06:01:09.742532	Details available The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Published: 2023-03-16T00:00:00.000Z Updated: 2024-08-02T12:30:24.515Z Open on db.gcve.eu Reference links https://github.com/request/request/issues/3442 https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf https://github.com/request/request/pull/3444 https://security.netapp.com/advisory/ntap-20230413-0007/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-16026`	vulnerable	2026-06-08 05:08:59.893654	Details available Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request >=2.2.6 <2.47.0 \|\| >2.51.0 <=2.67.0. Published: 2018-06-04T19:00:00.000Z Updated: 2024-09-16T17:28:08.484Z Open on db.gcve.eu Reference links https://github.com/request/request/pull/2018 https://nodesecurity.io/advisories/309 https://github.com/request/request/issues/1904	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.