npm request-filtering-agent vulnerabilities

Latest npm request-filtering-agent CVEs

Newest publication first

1. CVE-2026-62985 request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

   Published 2026-09-22

   High·CVSS 7.5 EPSS 0.56%

   request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 16...

2. CVE-2025-57814 request-filtering-agent SSRF Bypass via HTTPS Requests

   Published 2025-08-25

   Medium·CVSS 5.5 EPSS 0.46%

   request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Versions 1.x.x and earlier contain a vulnerability where HTTPS requests to 127.0.0.1 bypass IP address filtering, while HTTP requests are correctly blocked. This allo...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.