{"id":"GHSA-p8p7-x288-28g6","summary":"Server-Side Request Forgery in Request","details":"The `request` package through 2.88.2 for Node.js and the `@cypress/request` package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).\n\nNOTE: The `request` package is no longer supported by the maintainer.","aliases":["CVE-2023-28155"],"modified":"2026-07-17T21:09:31.151334392Z","published":"2023-03-16T15:30:19Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2023-03-16T18:33:48Z","nvd_published_at":"2023-03-16T15:15:00Z","cwe_ids":["CWE-918"],"severity":"MODERATE"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28155"},{"type":"WEB","url":"https://github.com/request/request/issues/3442"},{"type":"WEB","url":"https://github.com/cypress-io/request/pull/28"},{"type":"WEB","url":"https://github.com/github/advisory-database/pull/2500"},{"type":"WEB","url":"https://github.com/request/request/pull/3444"},{"type":"WEB","url":"https://github.com/cypress-io/request/commit/c5bcf21d40fb61feaff21a0e5a2b3934a440024f"},{"type":"WEB","url":"https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf"},{"type":"WEB","url":"https://github.com/cypress-io/request/blob/master/lib/redirect.js#L116"},{"type":"WEB","url":"https://github.com/cypress-io/request/releases/tag/v3.0.0"},{"type":"PACKAGE","url":"https://github.com/request/request"},{"type":"WEB","url":"https://github.com/request/request/blob/master/lib/redirect.js#L111"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20230413-0007"}],"affected":[{"package":{"name":"request","ecosystem":"npm","purl":"pkg:npm/request"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2.88.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-p8p7-x288-28g6/GHSA-p8p7-x288-28g6.json"}},{"package":{"name":"@cypress/request","ecosystem":"npm","purl":"pkg:npm/%40cypress/request"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 2.88.12","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-p8p7-x288-28g6/GHSA-p8p7-x288-28g6.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}