CVE-2026-62985

request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or 127.0.0.1. Because Node.js http.request and http.get expect connection failures to be delivered asynchronously, the throw bypassed req.on('error') and became an uncaught exception that could terminate the application process. Hostnames resolved through the asynchronous lookup path were not affected by this error-delivery asymmetry. This issue is fixed in version 3.2.1.

• CWE-248

• https://github.com/azu/request-filtering-agent/commit/9d12561064524807fc399158eaa5bd7a40dd8cd0
• https://github.com/azu/request-filtering-agent/releases/tag/v3.2.1
• https://github.com/azu/request-filtering-agent/security/advisories/GHSA-r3r9-wp5j-pq5g
• https://github.com/azu/request-filtering-agent/security/advisories/GHSA-r3r9-wp5j-pq5g

Published

Sep 22, 2026

Last Modified

Sep 26, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6296Heap buffer overflow in ANGLE in Google Chrome prior to 147.…9.6
• CVE-2026-62960Git for Windows is the Windows port of Git. Prior to 2.55.0.…7.4
• CVE-2026-62963Centrifugo is an open-source scalable real-time messaging se…8.7
• CVE-2026-6297Use after free in Proxy in Google Chrome prior to 147.0.7727…8.3
• CVE-2026-6298Heap buffer overflow in Skia in Google Chrome prior to 147.0…4.3
• CVE-2026-62982Glances is an open-source system cross-platform monitoring t…8.8
• CVE-2026-62986OpenEXR is the reference implementation and specification fo…4.3
• CVE-2026-62987Fabio is an HTTP(S) and TCP router for deploying application…5.8
• CVE-2026-62988Froxlor is open source server administration software. From …9
• CVE-2026-6299Use after free in Prerender in Google Chrome prior to 147.0.…8.8
• CVE-2026-62992Smarty is a template engine for PHP, facilitating the separa…6.9
• CVE-2026-62993Smarty is a template engine for PHP, facilitating the separa…6.9