request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

Summary RequestFilteringHttpAgent / RequestFilteringHttpsAgent block requests to private IPs, but the blocking happens via a synchronous throw inside createConnection for literal private-IP hostnames e.g. 169.254.169.254, 127.0.0.1. Node.js's http.request / http.get expects createConnection to em...

CVE-2026-62985 request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

request-filtering-agent is an https.Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or...

CVE-2026-62985

The request-filtering-agent library (an http(s).Agent implementation) is vulnerable to a denial of service before version 3.2.1 . The RequestFilteringHttpAgent and RequestFilteringHttpsAgent components synchronously throw from createConnection() when rejecting literal private-IP hosts (e.g., 127....