Vulnerabilities in pkg:npm/request-filtering-agent

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-r3r9-wp5j-pq5g",
  "modified" : "2026-09-22T19:54:18Z",
  "published" : "2026-09-22T19:54:18Z",
  "aliases" : [ "CVE-2026-62985" ],
  "summary" : "request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process",
  "details" : "### Summary\n`RequestFilteringHttpAgent` / `RequestFilteringHttpsAgent` block requests to private IPs, but the blocking happens via a **synchronous `throw`** inside `createConnection()` for literal private-IP hostnames (e.g. `169.254.169.254`, `127.0.0.1`). Node.js's `http.request` / `http.get` expects `createConnection` to emit an error asynchronously; a synchronous throw instead escapes the caller's `req.on('error', ...)` handler entirely and becomes an **unhandled exception** that crashes the process.\n\n### Affected\n`request-filtering-agent` <= 3.2.0 (latest).\n\n### PoC (replicated live on 3.2.0)\n```js\nconst http = require('http');\nconst { RequestFilteringHttpAgent } = require('request-filtering-agent');\nconst agent = new RequestFilteringHttpAgent();\nprocess.on('uncaughtException', e => {\n  console.log('CRASH:', e.message); // fires — process dies\n});\nconst req = http.get({ hostname: '169.254.169.254', port: 80, agent });\nreq.on('error', e => { /* never reached for literal IPs */ });\n```\nActual output:\n```\nrequest-filtering-agent@3.2.0 synchronous throw escaping error event:\nUNCAUGHT EXCEPTION (process crash): DNS lookup 169.254.169.254(...) is not allowed. Because, It is private IP address.\n*** CRASH CONFIRMED: createConnection throws sync, bypasses req.on(\"error\") ***\n```\nNote: hostnames that resolve to private IPs (e.g. `localhost`) are handled via the async lookup path and correctly emit an error event — this asymmetry confirms the sync-throw is a defect.\n\n### Impact\nAny application using `request-filtering-agent` where an attacker can trigger an HTTP request to a literal private-IP (e.g. from a user-supplied URL that is pre-validated but still reaches `http.get`) will crash the Node.js process — full DoS.\n\n### Fix\nInstead of throwing synchronously in `createConnection()`, call `callback(error)` (the Node.js `net.createConnection` error-callback convention) or use `process.nextTick(() => socket.destroy(error))` on the returned socket to emit the error asynchronously, allowing `req.on('error')` to handle it.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "request-filtering-agent"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.2.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/azu/request-filtering-agent/security/advisories/GHSA-r3r9-wp5j-pq5g"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/azu/request-filtering-agent/commit/9d12561064524807fc399158eaa5bd7a40dd8cd0"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/azu/request-filtering-agent"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/azu/request-filtering-agent/releases/tag/v3.2.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-248" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-22T19:54:18Z",
    "nvd_published_at" : null
  }
}