CVE-2026-62985

Received Received - Intake

RequestFilteringAgent Private IP Connection Throw in Node.js

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description

request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or 127.0.0.1. Because Node.js http.request and http.get expect connection failures to be delivered asynchronously, the throw bypassed req.on('error') and became an uncaught exception that could terminate the application process. Hostnames resolved through the asynchronous lookup path were not affected by this error-delivery asymmetry. This issue is fixed in version 3.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-62985

EUVD

EUVD-2026-84679

Affected Vendors & Products

Vendor	Product	Version / Range
azu	request-filtering-agent	to 3.2.1 (exc)
azu	request-filtering-agent	3.2.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability affects the request-filtering-agent library, which blocks requests to private or reserved IP addresses. In versions before 3.2.1, the library would synchronously throw an error when rejecting literal private IP hosts like 169.254.169.254 or 127.0.0.1. This bypassed Node.js's error handling, causing uncaught exceptions that could crash the application.

Detection Guidance

To detect this vulnerability, check if your application uses request-filtering-agent version 3.2.0 or below. Run: npm list request-filtering-agent. If the version is 3.2.0 or lower, the system is vulnerable. Test by sending a request to a literal private IP like 169.254.169.254 or 127.0.0.1 and observe if the application crashes due to an uncaught exception.

Impact Analysis

An attacker could exploit this to crash applications using the vulnerable library by sending requests to literal private IP addresses. This leads to a denial-of-service condition, as the application process terminates due to unhandled exceptions.

Compliance Impact

This vulnerability primarily impacts application availability by causing crashes when processing requests to private IP addresses. While it does not directly violate GDPR or HIPAA, it could lead to denial-of-service conditions that may affect data processing integrity or availability, which are key compliance requirements under these regulations.

Mitigation Strategies

Immediately update request-filtering-agent to version 3.2.1 or later using: npm update request-filtering-agent. If updating is not possible, modify the createConnection method to emit errors asynchronously instead of throwing synchronously, as described in the GitHub advisory.

Hi! I’m here to help you understand CVE-2026-62985. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70