CVE-2026-62985

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-62985
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62985.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-62985
Aliases
Published
2026-09-22T19:13:19Z
Modified
2026-09-27T03:30:47Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process
Details

request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or 127.0.0.1. Because Node.js http.request and http.get expect connection failures to be delivered asynchronously, the throw bypassed req.on('error') and became an uncaught exception that could terminate the application process. Hostnames resolved through the asynchronous lookup path were not affected by this error-delivery asymmetry. This issue is fixed in version 3.2.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-248"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62985.json"
}
References

Affected packages

Git / github.com/azu/request-filtering-agent

Affected ranges

Type
GIT
Repo
https://github.com/azu/request-filtering-agent
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9d12561064524807fc399158eaa5bd7a40dd8cd0
Fixed
2af890af1a24a834b8eb232b1aadfd0052e2e92c
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "3.2.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.0.1
1.0.2
1.0.3
1.0.4
v1.*
v1.0.5
v1.0.6
v1.0.7
v1.1.0
v1.1.2
v2.*
v2.0.0
v2.0.1
v3.*
v3.0.0
v3.0.2
v3.1.0
v3.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62985.json"