StackPrism

npm package

request vulnerabilities by version

The latest release, 2.88.2 (Feb 11, 2020), has 1 known vulnerability. 100% of last week’s 12.5M downloads went to versions with known vulnerabilities. OSV.dev lists 2 advisories for request; the newest was published on Mar 16, 2023. The maintainers have deprecated request.

npm (opens in a new tab) describes it as “Simplified HTTP request client.”

Latest release
2.88.2
Feb 11, 2020, 1 known vulnerabilities
Downloads last week
12.5M
All versions, from npm
Advisories on OSV.dev
2
Newest Mar 16, 2023
Licence
Apache-2.0
OpenSSF Scorecard
3.4/10
request/request (opens in a new tab)
Status
Deprecated
request has been deprecated, see https://github.com/request/request/issues/3142

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
2.88.2latestFeb 11, 20201 known vulnerability, worst rated warningDeprecated9.3M
2.88.0Aug 10, 20181 known vulnerability, worst rated warningDeprecated1.3M
2.81.0Mar 9, 20171 known vulnerability, worst rated warningDeprecated415K
2.83.0Sep 27, 20171 known vulnerability, worst rated warningDeprecated206.2K
2.79.0Nov 18, 20161 known vulnerability, worst rated warningDeprecated202.4K
2.87.0May 21, 20181 known vulnerability, worst rated warningDeprecated160.4K
2.40.0Aug 6, 20142 known vulnerabilities, worst rated warningDeprecated121.3K
2.85.0Mar 12, 20181 known vulnerability, worst rated warningDeprecated93.7K

Who is still on a vulnerable request

100% of last week’s 12.5M request downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

The newest release of each major line, from the registry. request doesn’t publish support dates we can check.

LineNewest releaseReleased
22.88.2Feb 11, 2020
11.9.9Jul 21, 2011
0.100.10.0Jan 22, 2011
0.90.9.5Jan 22, 2011
0.80.8.3Jan 22, 2011

Newest advisories

The 2 most recently published, with the versions each one affects.

  1. WarningCVE-2023-28155 on OSV.dev (opens in a new tab)GHSA-p8p7-x288-28g6

    Server-Side Request Forgery in Request

    Affects <= 2.88.2. Published Mar 16, 2023.

  2. WarningCVE-2017-16026 on OSV.dev (opens in a new tab)GHSA-7xfp-9c55-5vqj

    Remote Memory Exposure in request

    Affects >= 2.49.0, < 2.68.0; >= 2.2.6, < 2.68.0. Published Nov 9, 2018.

Which request do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for request, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm and deps.dev.