PatchVault › Errors › request → native fetch

Server-Side Request Forgery in Request (CVE-2023-28155)

npm audit reports GHSA-p8p7-x288-28g6 (moderate) for request ≤ 2.88.2. The package is unmaintained, so no patched request release exists.

Check your code free (runs in your browser)

The box is pre-filled with a sample that triggers this error. Paste your own file to check it. Nothing leaves this page.

Or scan your whole repo locally (free, stdlib Python, read-only):

python3 <(curl -fsSL https://patchvault-81y.pages.dev/starters/request-fetch-scan.py) .
Get the request → native fetch auto-fixer: $9 one-time

Why it happens

The advisory concerns cross-protocol redirects that can bypass SSRF protections. The fix is to remove request from the tree: replace direct use with fetch, and upgrade or replace parents that depend on it.

Manual fix

npm ls request
# direct dependency -> remove and use fetch
npm uninstall request
# transitive -> upgrade the parent shown by npm ls, or (last resort) an npm "overrides" entry

Verify

Re-run your install/build and re-scan the file above. The finding should be gone. The paid fixer applies the same change across a repo: --dry-run shows the diff, --apply keeps a .bak of each file, and --rollback restores them.

Sources

Related errors

Full guide and free terminal scanner: request → native fetch. Last checked 2026-10-31.