CVE-2026-62985

Name of the Vulnerable Software and Affected Versions request-filtering-agent versions prior to 3.2.1

Description RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously throw an error from the createConnection() function when rejecting a literal private-IP host, such as 169.254.169.254 or 127.0.0.1. Since Node.js http.request and http.get expect connection failures to be delivered asynchronously, this synchronous throw bypasses the req.on('error') handler, resulting in an uncaught exception that can terminate the application process and lead to a full Denial of Service (DoS).

Recommendations Update request-filtering-agent to version 3.2.1.