Packages / request / Security

ModerateVulnerabilityGHSA-p8p7-x288-28g6CVE-2023-28155Published 16 Mar 2023

Server-Side Request Forgery in Request

Affected releases · request

  • 2.x2.0.0 – 2.88.2No fix on this line yet
  • 1.x and older0.8.3 – 1.9.9No fix, no longer updated

No release fixes it yet, not even the latest, 2.88.2.

2.x

  1. Affected

    2.0.0 – 2.88.2

    109 releases, latest

1.x

  1. Affected

    1.0.0 – 1.9.9

    12 releases

0.x

  1. Affected

    0.8.3 – 0.10.0

    5 releases

126 stable releases of request, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for request. It is read in your browser and sent nowhere.

What happens

The request package through 2.88.2 for Node.js and the @cypress/request package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).

NOTE: The request package is no longer supported by the maintainer.