CVE-2026-62985

request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or 127.0.0.1. Because Node.js http.request and http.get expect connection failures to be delivered asynchronously, the throw bypassed req.on('error') and became an uncaught exception that could terminate the application process. Hostnames resolved through the asynchronous lookup path were not affected by this error-delivery asymmetry. This issue is fixed in version 3.2.1.

• CWE-248

• https://github.com/azu/request-filtering-agent/commit/9d12561064524807fc399158eaa5bd7a40dd8cd0
• https://github.com/azu/request-filtering-agent/releases/tag/v3.2.1
• https://github.com/azu/request-filtering-agent/security/advisories/GHSA-r3r9-wp5j-pq5g
• https://github.com/azu/request-filtering-agent/security/advisories/GHSA-r3r9-wp5j-pq5g

Published

Sep 22, 2026

Last Modified

Sep 26, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62975BACnet Stack is a BACnet open source protocol stack C librar…6.9
• CVE-2026-62976BACnet Stack is a BACnet open source protocol stack C librar…8.7
• CVE-2026-62977BACnet Stack is a BACnet open source protocol stack C librar…6.9
• CVE-2026-62979jack lets users share media libraries through their Radarr/S…8.4
• CVE-2026-6298Heap buffer overflow in Skia in Google Chrome prior to 147.0…4.3
• CVE-2026-62982Glances is an open-source system cross-platform monitoring t…8.8
• CVE-2026-62986OpenEXR is the reference implementation and specification fo…4.3
• CVE-2026-62987Fabio is an HTTP(S) and TCP router for deploying application…5.8
• CVE-2026-62988Froxlor is open source server administration software. From …9
• CVE-2026-62989Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.…8.1
• CVE-2026-6299Use after free in Prerender in Google Chrome prior to 147.0.…8.8
• CVE-2026-62990Shopper is a Headless e-commerce Admin Panel. In versions fr…8.7