CVE-2025-57814: Request filtering agent Request-filtering-agent SSRF Bypass Vulnerability
MODERATECVE-2025-57814 is a MODERATE request-filtering-agent ssrf bypass vulnerability (CWE-918: Server-Side Request Forgery (SSRF)) affecting Request filtering agent libraries in the npm ecosystem. The issue involves request-filtering-agent ssrf bypass via https requests to 127.0.0.1. Remediation is available by upgrading affected packages to version 2.0.0.
CVE-2025-57814 at a Glance
How to Fix CVE-2025-57814
To remediate this vulnerability, upgrade all affected Request filtering agent dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install request-filtering-agent@2.0.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls request-filtering-agentHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2025-57814, inspect your project dependencies using npm:
npm ls request-filtering-agentAnalyze the terminal output to locate any version of Request filtering agent in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.0.0), your application is affected.
Note: The npm ls request-filtering-agent command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-918: Server-Side Request Forgery (SSRF), where the web server receives a url or similar request from an upstream component and retrieves the contents of this url, but it does not sufficiently ensure that the request is being sent to the expected destination. In Request filtering agent, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-57814 Affected Request filtering agent Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
request-filtering-agent
|
npm |
< 2.0.0
|
2.0.0
|
References
Frequently Asked Questions
What is CVE-2025-57814?
Which Request filtering agent versions are affected?
What version fixes CVE-2025-57814?
Is request-filtering-agent affected?
What CWE is associated with CVE-2025-57814?
How can I check npm dependencies for CVE-2025-57814?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-pw25-c82r-75mm",
"modified" : "2025-08-26T17:12:50Z",
"published" : "2025-08-25T21:48:01Z",
"aliases" : [ "CVE-2025-57814" ],
"summary" : "request-filtering-agent SSRF Bypass via HTTPS Requests to 127.0.0.1",
"details" : "request-filtering-agent versions 1.x.x and earlier contain a vulnerability where HTTPS requests to 127.0.0.1 bypass IP address filtering, while HTTP requests are correctly blocked.\n\n**Impact:**\n\nVulnerable patterns (requests that should be blocked but are allowed):\n- https://127.0.0.1:443/api\n- https://127.0.0.1:8443/admin\n- Any HTTPS request using direct IP address `https://127.0.0.1`\n\nThis vulnerability primarily affects services using self-signed certificates on `127.0.0.1`.\n\n**Not affected (correctly blocked in all versions):**\n- http://127.0.0.1:80/api - HTTP requests are properly blocked\n- https://localhost:443/api - Domain-based requests trigger DNS lookup and are blocked\n- http://localhost:80/api - Domain-based HTTP requests are blocked\n- Requests to other private IPs like 192.168.x.x, 10.x.x.x, 172.16.x.x\n\nThis allows attackers to potentially access internal HTTPS services running on localhost, bypassing the library's SSRF protection. The vulnerability is particularly dangerous when the application accepts user-controlled URLs and internal services are only protected by network-level restrictions.\n\n## Fixed in 2.0.0\n\nThis vulnerability has been fixed in request-filtering-agent version 2.0.0. Users should upgrade to version 2.0.0 or later.\n\nRoot Cause:The HTTPS agent fails to validate direct IP addresses like `https://127.0.0.1` during TLS connection setup, allowing them to bypass the security filter.\n\nDetails: https://github.com/azu/request-filtering-agent-https127-test\n\nThanks Luca",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "request-filtering-agent"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2.0.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/azu/request-filtering-agent/security/advisories/GHSA-pw25-c82r-75mm"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-57814"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/azu/request-filtering-agent"
}, {
"type" : "WEB",
"url" : "https://github.com/azu/request-filtering-agent-https127-test"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-918" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2025-08-25T21:48:01Z",
"nvd_published_at" : "2025-08-25T22:15:33Z"
}
}