CVE-2026-62985: request-filtering-agent Synchronous Throw in createConnection() Crashes Node.js Process
Summary
CVE-2026-62985: RequestFilteringHttpAgent / RequestFilteringHttpsAgent block requests to private IPs, but the blocking happens via a synchronous throw inside createConnection() for literal private-IP hostnames (e.g. Affects request-filtering-agent versions < 3.2.1. Fixed in 3.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The request-filtering-agent is an npm package designed to block HTTP requests to private IP addresses, enhancing security by preventing potential internal network attacks. However, it has a critical flaw in its implementation, where it synchronously throws an error instead of handling it asynchronously, leading to application crashes.
Vulnerability Detail
The vulnerability arises from the synchronous throw in the createConnection() method of the RequestFilteringHttpAgent and RequestFilteringHttpsAgent classes. When a request is made to a literal private IP address (e.g., 169.254.169.254), the synchronous throw bypasses the req.on('error') handler, resulting in an unhandled exception that crashes the Node.js process. This can lead to a Denial of Service (DoS) if an attacker can trigger such requests, making it a significant security risk.
How To Fix
Latest published version: 3.2.1 as of 23 Oct 2026
npm install request-filtering-agent@3.2.1The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement error handling in your application to catch unhandled exceptions. Here’s an example code snippet:
const http = require('http');
const { RequestFilteringHttpAgent } = require('request-filtering-agent');
const agent = new RequestFilteringHttpAgent();
process.on('uncaughtException', e => {
console.log('CRASH:', e.message);
// This will log the error message
});
const req = http.get({ hostname: '169.254.169.254', port: 80, agent });
req.on('error', e => {
console.error('Error occurred:', e.message);
// Handle the error appropriately
});
Conclusion
The request-filtering-agent package has a critical vulnerability that can lead to application crashes when handling requests to private IP addresses. It is essential to update to version 3.2.1 or later to mitigate this risk. Implementing proper error handling can serve as a temporary measure while you work on the update.
See every vulnerability recorded for request-filtering-agent →
FAQ
CVE-2026-62985 is a vulnerability in the request-filtering-agent package that causes Node.js applications to crash when making requests to literal private IP addresses.
If your application uses the request-filtering-agent package and allows user-supplied URLs, an attacker could trigger a request to a private IP, leading to a crash and Denial of Service.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application's package-lock.json for vulnerabilities without requiring signup.
Implement error handling in your application to catch unhandled exceptions as a temporary workaround until you can update the package.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for request-filtering-agent.
