CVE-2026-62985 request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process
An attacker can crash the Node.js application by triggering a synchronous exception in the request-filtering-agent when blocking private IP addresses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-62985?
CVE-2026-62985 is a high-severity denial of service vulnerability in azu request-filtering-agent, published on 22 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or 127.0.0.1. Because Node.js http.request and http.get expect connection failures to be delivered asynchronously, the throw bypassed req.on('error') and became an uncaught exception that could terminate the application process. Hostnames resolved through the asynchronous lookup path were not affected by this error-delivery asymmetry. This issue is fixed in version 3.2.1.
Weakness: CWE-248
Which versions are affected by CVE-2026-62985?
2 open source packages ship an affected version, including request-filtering-agent.
| Package | Affected | Fixed in |
|---|---|---|
request-filtering-agent npm | All versions | 3.2.1 |
request-filtering-agent npm | All versions | 3.2.1 |
How do I fix CVE-2026-62985?
Upgrade request-filtering-agent to 3.2.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-62985 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62985 exists.
Sources
Also known as GHSA-r3r9-wp5j-pq5g.