Vulnerability in request-filtering-agent (CVE-2026-62985)
Summary
Vulnerability in request-filtering-agent (CVE-2026-62985). Risk of unauthorized operations or information disclosure. Exploitable via RequestFilteringHttpAgent. Mitigation: upgrade to 3.2.1 or later.
Original description
The description as published by the source.
Summary
RequestFilteringHttpAgent / RequestFilteringHttpsAgent block requests to private IPs, but the blocking happens via a synchronous throw inside createConnection() for literal private-IP hostnames (e.g. 169.254.169.254, 127.0.0.1). Node.js's http.request / http.get expects createConnection to emit an error asynchronously; a synchronous throw instead escapes the caller's req.on('error', ...) handler entirely and becomes an unhandled exception that crashes the process.
Affected
request-filtering-agent <= 3.2.0 (latest).
PoC (replicated live on 3.2.0)
const http = require('http');
const { RequestFilteringHttpAgent } = require('request-filtering-agent');
const agent = new RequestFilteringHttpAgent();
process.on('uncaughtException', e => {
console.log('CRASH:', e.message); // fires — process dies
});
const req = http.get({ hostname: '169.254.169.254', port: 80, agent });
req.on('error', e => { /* never reached for literal IPs */ });
Actual output:
request-filtering-agent@3.2.0 synchronous throw escaping error event:
UNCAUGHT EXCEPTION (process crash): DNS lookup 169.254.169.254(...) is not allowed. Because, It is private IP address.
*** CRASH CONFIRMED: createConnection throws sync, bypasses req.on("error") ***
Note: hostnames that resolve to private IPs (e.g. localhost) are handled via the async lookup path and correctly emit an error event — this asymmetry confirms the sync-throw is a defect.
Impact
Any…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-62985 has been found in request-filtering-agent.
Attackers can target a specific entry point like RequestFilteringHttpAgent over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 7.5/10.
What to do: upgrade request-filtering-agent to 3.2.1 or later.
If unsure, ask your IT team or search "request-filtering-agent CVE-2026-62985" on the vendor's site.
CVE-2026-62985 (request-filtering-agent) — CWE-248 / CVSS v3 7.5
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: RequestFilteringHttpAgent / RequestFilteringHttpsAgent / throw / http.request
Patched: 3.2.1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-248) exists in request-filtering-agent. Attackers reach the vulnerable code path via RequestFilteringHttpAgent without authentication.
Check the vendor advisory for the affected versions of request-filtering-agent. Attack surface: RequestFilteringHttpAgent / RequestFilteringHttpsAgent / throw / http.request.
Severity: High (CVSS 7.5/10). Risk of unauthorized operations or information disclosure.
Update to 3.2.1.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'request-filtering-agent' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'request-filtering-agent' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
request-filtering-agentを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade request-filtering-agent to 3.2.1ステージング環境で 3.2.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- web github.com
- web github.com
- web github.com
- web github.com