2vulnerabilities
- Critical0 (0.0%)
- High1 (50.0%)
- Medium0 (0.0%)
- Moderate1 (50.0%)
- Low0 (0.0%)
request-filtering-agent
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting request-filtering-agent, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-r3r9-wp5j-pq5g | High | request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process### Summary `RequestFilteringHttpAgent` / `RequestFilteringHttpsAgent` block requests to private IPs, but the blocking happens via a **synchronous `throw`** inside `createConnection()` for literal private-IP hostnames (e.g. `169.254.169.254`, `127.0.0.1`). Node.js's `http.request` / `http.get` expects `createConnection` to emit an error asynchronously; a synchronous throw instead escapes the caller's `req.on('error', ...)` handler entirely and becomes an **unhandled exception** that crashes the process. ### Affected `request-filtering-agent` <= 3.2.0 (latest). ### PoC (replicated live on 3.2 |
| GitHub (opens in a new tab) | |
| GHSA-pw25-c82r-75mm | Moderate | request-filtering-agent SSRF Bypass via HTTPS Requests to 127.0.0.1request-filtering-agent versions 1.x.x and earlier contain a vulnerability where HTTPS requests to 127.0.0.1 bypass IP address filtering, while HTTP requests are correctly blocked. **Impact:** Vulnerable patterns (requests that should be blocked but are allowed): - https://127.0.0.1:443/api - https://127.0.0.1:8443/admin - Any HTTPS request using direct IP address `https://127.0.0.1` This vulnerability primarily affects services using self-signed certificates on `127.0.0.1`. **Not affected (correctly blocked in all versions):** - http://127.0.0.1:80/api - HTTP requests are properly blocked |
| GitHub (opens in a new tab) |
- GHSA-r3r9-wp5j-pq5gHighrequest-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process
< 3.2.1
### Summary `RequestFilteringHttpAgent` / `RequestFilteringHttpsAgent` block requests to private IPs, but the blocking happens via a **synchronous `throw`** inside `createConnection()` for literal private-IP hostnames (e.g. `169.254.169.254`, `127.0.0.1`). Node.js's `http.request` / `http.get` expects `createConnection` to emit an error asynchronously; a synchronous throw instead escapes the caller's `req.on('error', ...)` handler entirely and becomes an **unhandled exception** that crashes the process. ### Affected `request-filtering-agent` <= 3.2.0 (latest). ### PoC (replicated live on 3.2
CVE: CVE-2026-62985
- GHSA-pw25-c82r-75mmModeraterequest-filtering-agent SSRF Bypass via HTTPS Requests to 127.0.0.1
< 2.0.0
request-filtering-agent versions 1.x.x and earlier contain a vulnerability where HTTPS requests to 127.0.0.1 bypass IP address filtering, while HTTP requests are correctly blocked. **Impact:** Vulnerable patterns (requests that should be blocked but are allowed): - https://127.0.0.1:443/api - https://127.0.0.1:8443/admin - Any HTTPS request using direct IP address `https://127.0.0.1` This vulnerability primarily affects services using self-signed certificates on `127.0.0.1`. **Not affected (correctly blocked in all versions):** - http://127.0.0.1:80/api - HTTP requests are properly blocked
CVE: CVE-2025-57814