request-filtering-agent Denial-of-Service Flaw: Uncaught Exception Can Crash Node.js Apps (CVE-2026-62985)

What Happened

request-filtering-agent provides RequestFilteringHttpAgent and RequestFilteringHttpsAgent, which are designed to block connections to private or reserved IP addresses. Prior to version 3.2.1, when a request targeted a literal private-IP host — such as 169.254.169.254 or 127.0.0.1 — the library's createConnection function threw an exception synchronously instead of surfacing the error asynchronously as Node.js's http.request and http.get APIs expect.

Technical Cause

Node.js's http.request and http.get expect connection errors to be delivered asynchronously via the standard req.on('error') event. Because createConnection in affected versions threw synchronously when rejecting a literal private-IP host, this error bypassed req.on('error') entirely and became an uncaught exception at the process level. Note that hostnames resolved via the library's asynchronous DNS lookup path were not affected by this specific error-delivery asymmetry — the issue is limited to literal IP addresses provided directly as the request target. This is classified as CWE-248 (Uncaught Exception).

Why It Matters

An uncaught exception in Node.js can crash the entire process if no global handler is in place, resulting in a denial of service for the application. Since the trigger condition involves a request to a literal private IP address — something an attacker could induce in applications that pass user-supplied URLs or hosts to outbound HTTP requests — this could be leveraged to disrupt availability without requiring authentication or user interaction.

Affected Versions

All versions of request-filtering-agent prior to 3.2.1 are affected. The issue is fixed in version 3.2.1.

Fixes and Mitigation

The vendor has released version 3.2.1, which addresses the synchronous throw behavior. Applications using request-filtering-agent should upgrade to 3.2.1 or later as soon as practical.

Recommended Action

Upgrade request-filtering-agent to version 3.2.1 or later. If immediate upgrading is not possible, ensure global exception handlers are in place for your Node.js process to prevent an uncaught exception from terminating the application, and review any code paths that pass untrusted or user-controlled hosts directly to outbound HTTP requests.