Vulnerability-Lookup

CVE-2026-62985 (GCVE-0-2026-62985)

Vulnerability from cvelistv5 – Published: 2026-09-22 19:13 – Updated: 2026-09-22 19:13

Title

request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

Summary

request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or 127.0.0.1. Because Node.js http.request and http.get expect connection failures to be delivered asynchronously, the throw bypassed req.on('error') and became an uncaught exception that could terminate the application process. Hostnames resolved through the asynchronous lookup path were not affected by this error-delivery asymmetry. This issue is fixed in version 3.2.1.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-248 - Uncaught Exception

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/azu/request-filtering-agent/se…	x_refsource_CONFIRM
https://github.com/azu/request-filtering-agent/co…	x_refsource_MISC
https://github.com/azu/request-filtering-agent/re…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
azu	request-filtering-agent	Affected: < 3.2.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "request-filtering-agent",
          "vendor": "azu",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or 127.0.0.1. Because Node.js http.request and http.get expect connection failures to be delivered asynchronously, the throw bypassed req.on(\u0027error\u0027) and became an uncaught exception that could terminate the application process. Hostnames resolved through the asynchronous lookup path were not affected by this error-delivery asymmetry. This issue is fixed in version 3.2.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T19:13:19.704Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/azu/request-filtering-agent/security/advisories/GHSA-r3r9-wp5j-pq5g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/azu/request-filtering-agent/security/advisories/GHSA-r3r9-wp5j-pq5g"
        },
        {
          "name": "https://github.com/azu/request-filtering-agent/commit/9d12561064524807fc399158eaa5bd7a40dd8cd0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/azu/request-filtering-agent/commit/9d12561064524807fc399158eaa5bd7a40dd8cd0"
        },
        {
          "name": "https://github.com/azu/request-filtering-agent/releases/tag/v3.2.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/azu/request-filtering-agent/releases/tag/v3.2.1"
        }
      ],
      "source": {
        "advisory": "GHSA-r3r9-wp5j-pq5g",
        "discovery": "UNKNOWN"
      },
      "title": "request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on(\u0027error\u0027), crashing the Node.js process"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62985",
    "datePublished": "2026-09-22T19:13:19.704Z",
    "dateReserved": "2026-07-14T22:48:09.781Z",
    "dateUpdated": "2026-09-22T19:13:19.704Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-62985",
      "date": "2026-09-23",
      "epss": "0.00655",
      "percentile": "0.49998"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "request-filtering-agent",
                "vendor": "azu",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 3.2.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or 127.0.0.1. Because Node.js http.request and http.get expect connection failures to be delivered asynchronously, the throw bypassed req.on(\u0027error\u0027) and became an uncaught exception that could terminate the application process. Hostnames resolved through the asynchronous lookup path were not affected by this error-delivery asymmetry. This issue is fixed in version 3.2.1."
          }
        ],
        "id": "CVE-2026-62985",
        "lastModified": "2026-09-23T18:12:04.247",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-22T20:17:04.443",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/azu/request-filtering-agent/commit/9d12561064524807fc399158eaa5bd7a40dd8cd0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/azu/request-filtering-agent/releases/tag/v3.2.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/azu/request-filtering-agent/security/advisories/GHSA-r3r9-wp5j-pq5g"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-248"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

FKIE_CVE-2026-62985

Vulnerability from fkie_nvd - Published: 2026-09-22 20:17 - Updated: 2026-09-23 18:12

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/azu/request-filtering-agent/commit/9d12561064524807fc399158eaa5bd7a40dd8cd0
	security-advisories@github.com	https://github.com/azu/request-filtering-agent/releases/tag/v3.2.1
	security-advisories@github.com	https://github.com/azu/request-filtering-agent/security/advisories/GHSA-r3r9-wp5j-pq5g

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "request-filtering-agent",
          "vendor": "azu",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or 127.0.0.1. Because Node.js http.request and http.get expect connection failures to be delivered asynchronously, the throw bypassed req.on(\u0027error\u0027) and became an uncaught exception that could terminate the application process. Hostnames resolved through the asynchronous lookup path were not affected by this error-delivery asymmetry. This issue is fixed in version 3.2.1."
    }
  ],
  "id": "CVE-2026-62985",
  "lastModified": "2026-09-23T18:12:04.247",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-22T20:17:04.443",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/azu/request-filtering-agent/commit/9d12561064524807fc399158eaa5bd7a40dd8cd0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/azu/request-filtering-agent/releases/tag/v3.2.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/azu/request-filtering-agent/security/advisories/GHSA-r3r9-wp5j-pq5g"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-248"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-R3R9-WP5J-PQ5G

Vulnerability from github – Published: 2026-09-22 19:54 – Updated: 2026-09-22 19:54

Summary

request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

Details

Summary

RequestFilteringHttpAgent / RequestFilteringHttpsAgent block requests to private IPs, but the blocking happens via a synchronous throw inside createConnection() for literal private-IP hostnames (e.g. 169.254.169.254, 127.0.0.1). Node.js's http.request / http.get expects createConnection to emit an error asynchronously; a synchronous throw instead escapes the caller's req.on('error', ...) handler entirely and becomes an unhandled exception that crashes the process.

Affected

request-filtering-agent <= 3.2.0 (latest).

PoC (replicated live on 3.2.0)

const http = require('http');
const { RequestFilteringHttpAgent } = require('request-filtering-agent');
const agent = new RequestFilteringHttpAgent();
process.on('uncaughtException', e => {
  console.log('CRASH:', e.message); // fires — process dies
});
const req = http.get({ hostname: '169.254.169.254', port: 80, agent });
req.on('error', e => { /* never reached for literal IPs */ });

Actual output:

request-filtering-agent@3.2.0 synchronous throw escaping error event:
UNCAUGHT EXCEPTION (process crash): DNS lookup 169.254.169.254(...) is not allowed. Because, It is private IP address.
*** CRASH CONFIRMED: createConnection throws sync, bypasses req.on("error") ***

Note: hostnames that resolve to private IPs (e.g. localhost) are handled via the async lookup path and correctly emit an error event — this asymmetry confirms the sync-throw is a defect.

Impact

Any application using request-filtering-agent where an attacker can trigger an HTTP request to a literal private-IP (e.g. from a user-supplied URL that is pre-validated but still reaches http.get) will crash the Node.js process — full DoS.

Fix

Instead of throwing synchronously in createConnection(), call callback(error) (the Node.js net.createConnection error-callback convention) or use process.nextTick(() => socket.destroy(error)) on the returned socket to emit the error asynchronously, allowing req.on('error') to handle it.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "request-filtering-agent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-62985"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T19:54:18Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n`RequestFilteringHttpAgent` / `RequestFilteringHttpsAgent` block requests to private IPs, but the blocking happens via a **synchronous `throw`** inside `createConnection()` for literal private-IP hostnames (e.g. `169.254.169.254`, `127.0.0.1`). Node.js\u0027s `http.request` / `http.get` expects `createConnection` to emit an error asynchronously; a synchronous throw instead escapes the caller\u0027s `req.on(\u0027error\u0027, ...)` handler entirely and becomes an **unhandled exception** that crashes the process.\n\n### Affected\n`request-filtering-agent` \u003c= 3.2.0 (latest).\n\n### PoC (replicated live on 3.2.0)\n```js\nconst http = require(\u0027http\u0027);\nconst { RequestFilteringHttpAgent } = require(\u0027request-filtering-agent\u0027);\nconst agent = new RequestFilteringHttpAgent();\nprocess.on(\u0027uncaughtException\u0027, e =\u003e {\n  console.log(\u0027CRASH:\u0027, e.message); // fires \u2014 process dies\n});\nconst req = http.get({ hostname: \u0027169.254.169.254\u0027, port: 80, agent });\nreq.on(\u0027error\u0027, e =\u003e { /* never reached for literal IPs */ });\n```\nActual output:\n```\nrequest-filtering-agent@3.2.0 synchronous throw escaping error event:\nUNCAUGHT EXCEPTION (process crash): DNS lookup 169.254.169.254(...) is not allowed. Because, It is private IP address.\n*** CRASH CONFIRMED: createConnection throws sync, bypasses req.on(\"error\") ***\n```\nNote: hostnames that resolve to private IPs (e.g. `localhost`) are handled via the async lookup path and correctly emit an error event \u2014 this asymmetry confirms the sync-throw is a defect.\n\n### Impact\nAny application using `request-filtering-agent` where an attacker can trigger an HTTP request to a literal private-IP (e.g. from a user-supplied URL that is pre-validated but still reaches `http.get`) will crash the Node.js process \u2014 full DoS.\n\n### Fix\nInstead of throwing synchronously in `createConnection()`, call `callback(error)` (the Node.js `net.createConnection` error-callback convention) or use `process.nextTick(() =\u003e socket.destroy(error))` on the returned socket to emit the error asynchronously, allowing `req.on(\u0027error\u0027)` to handle it.",
  "id": "GHSA-r3r9-wp5j-pq5g",
  "modified": "2026-09-22T19:54:18Z",
  "published": "2026-09-22T19:54:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/azu/request-filtering-agent/security/advisories/GHSA-r3r9-wp5j-pq5g"
    },
    {
      "type": "WEB",
      "url": "https://github.com/azu/request-filtering-agent/commit/9d12561064524807fc399158eaa5bd7a40dd8cd0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/azu/request-filtering-agent"
    },
    {
      "type": "WEB",
      "url": "https://github.com/azu/request-filtering-agent/releases/tag/v3.2.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on(\u0027error\u0027), crashing the Node.js process"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-62985 (GCVE-0-2026-62985)

FKIE_CVE-2026-62985

GHSA-R3R9-WP5J-PQ5G

Summary

Affected

PoC (replicated live on 3.2.0)

Impact

Fix

Tags

Sightings

Nomenclature

Related by attack behaviour