Synchronous Exception Handling Issue in Request Filtering Agent by Azu
CVE-2026-62985

7.5HIGH

Key Information:

Vendor

Azu

Status
Request-filtering-agent
Vendor
CVE Published:
22 September 2026

What is CVE-2026-62985?

The Request Filtering Agent, designed to block requests to private or reserved IP addresses, exhibited a flaw in its error handling. Prior to version 3.2.1, the implementation would synchronously throw exceptions when processing connections to literal private IP hosts, such as 169.254.169.254 or 127.0.0.1. This behavior was problematic as Node.js expects connection errors to be handled asynchronously, leading to uncaught exceptions that could crash the application process. The issue affected connections made to these private IPs, whereas hostnames resolved through an async lookup path remained operable without issue. This bug is addressed in version 3.2.1, enhancing the stability of applications utilizing this agent.

Affected Version(s)

request-filtering-agent < 3.2.1

References

https://github.com/azu/request-filtering-agent/security/a...
x_refsource_CONFIRM
https://github.com/azu/request-filtering-agent/commit/9d1...
x_refsource_MISC
https://github.com/azu/request-filtering-agent/releases/t...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.