---
id: CVE-2026-62985
title: >-
  request-filtering-agent is an http(s).Agent implementation that blocks
  requests to Private/Reserved IP addresses
summary: >-
  request-filtering-agent is an http(s).Agent implementation that blocks
  requests to Private/Reserved IP addresses. Prior to 3.2.1,
  RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw
  from createConnection when rej…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-248
vendor: request-filtering-agent
product: request-filtering-agent
affected:
  - request-filtering-agent < 3.2.1
patched:
  - request-filtering-agent 3.2.1
published: '2026-09-22'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:12:04.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-62985'
references:
  - url: >-
      https://github.com/azu/request-filtering-agent/commit/9d12561064524807fc399158eaa5bd7a40dd8cd0
    label: security-advisories@github.com
  - url: 'https://github.com/azu/request-filtering-agent/releases/tag/v3.2.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/azu/request-filtering-agent/security/advisories/GHSA-r3r9-wp5j-pq5g
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-r3r9-wp5j-pq5g'
tags:
  - nvd
  - ghsa
  - npm
  - cve.org
epss: 0.00655
epssPercentile: 0.49998
aliases:
  - GHSA-r3r9-wp5j-pq5g
ecosystem: npm
ingestedAt: '2026-09-22T20:10:15.092Z'
---

## Overview

request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or 127.0.0.1. Because Node.js http.request and http.get expect connection failures to be delivered asynchronously, the throw bypassed req.on('error') and became an uncaught exception that could terminate the application process. Hostnames resolved through the asynchronous lookup path were not affected by this error-delivery asymmetry. This issue is fixed in version 3.2.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-62985)

Affected packages:

- `request-filtering-agent < 3.2.1`

Patched in:

- `request-filtering-agent 3.2.1`

Source: https://github.com/advisories/GHSA-r3r9-wp5j-pq5g