Security readout for executives and security teams
Plain-English summary
This vulnerability concerns the Node.js request HTTP client. In affected versions, multipart requests with a numeric body can include non-zero memory content in the request body, creating an information exposure risk. The supplied sources do not provide CVSS scoring or evidence of active exploitation.
Executive priority
Prioritize as dependency hygiene with possible data exposure impact. Escalate if affected versions are present in systems processing sensitive data or externally influenced multipart requests. Current urgency is constrained by missing severity, CVSS, and exploitation evidence.
Technical view
CVE-2017-16026 is mapped to CWE-201. Affected request versions are >=2.2.6 <2.47.0 and >2.51.0 <=2.67.0. The issue is triggered in multipart handling when the body value is a number, causing the specified amount of non-zero memory to be passed in the body.
Likely exposure
Exposure is most likely in Node.js applications that depend on affected request versions and create multipart requests. Risk is higher where multipart body values are influenced by application data or user-controlled input. The bundle does not identify affected deployments beyond the request node module version ranges.
Exploitation context
The source bundle does not show KEV listing, public exploitation, or exploit maturity. Treat this as a potential information disclosure flaw until dependency inventory and multipart usage are confirmed. Do not assume exploitation without additional cited evidence.
Researcher notes
Evidence is limited to the CVE description, affected ranges, CWE-201, and referenced request issue, PR, and Node Security advisory. No exploit status, CVSS vector, or concrete patch version is provided in the supplied bundle.
Mitigation direction
- Inventory all request dependency versions in manifests, lockfiles, and SBOMs.
- Move affected request versions outside the listed vulnerable ranges using maintainer guidance.
- Review referenced advisory and pull request for confirmed remediation details.
- Reduce or remove multipart paths that pass numeric body values where feasible.
- Prioritize systems handling sensitive data in outbound multipart requests.
Validation and detection
- Check whether request versions match >=2.2.6 <2.47.0 or >2.51.0 <=2.67.0.
- Search application code for request multipart usage.
- Confirm whether multipart body values can become numbers.
- Review outbound multipart flows for sensitive memory disclosure impact.
- Document evidence, affected services, and remediation decisions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-201: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2017-16026 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/request/request/pull/2018CVE reference · x_refsource_MISC
- https://nodesecurity.io/advisories/309CVE reference · x_refsource_MISC
- https://github.com/request/request/issues/1904CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.