CVE-2025-57814 request-filtering-agent SSRF Bypass via HTTPS Requests
Attackers can bypass SSRF protections to access internal localhost services via HTTPS requests in the request-filtering-agent library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-57814?
CVE-2025-57814 is a medium-severity server-side request forgery vulnerability in azu request-filtering-agent, published on 25 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Versions 1.x.x and earlier contain a vulnerability where HTTPS requests to 127.0.0.1 bypass IP address filtering, while HTTP requests are correctly blocked. This allows attackers to potentially access internal HTTPS services running on localhost, bypassing the library's SSRF protection. The vulnerability is particularly dangerous when the application accepts user-controlled URLs and internal services are only protected by network-level restrictions. This vulnerability has been fixed in request-filtering-agent version 2.0.0. Users should upgrade to version 2.0.0 or later.
Weakness: CWE-918
Which versions are affected by CVE-2025-57814?
2 open source packages ship an affected version, including request-filtering-agent.
| Package | Affected | Fixed in |
|---|---|---|
request-filtering-agent npm | All versions | 2.0.0 |
request-filtering-agent npm | All versions | 2.0.0 |
How do I fix CVE-2025-57814?
Upgrade request-filtering-agent to 2.0.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-57814 being exploited?
There is no known exploitation of CVE-2025-57814 in the wild and no public exploit code.
Sources
Also known as GHSA-pw25-c82r-75mm.