Advisories for Npm/Request-Filtering-Agent package

2026

request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

RequestFilteringHttpAgent / RequestFilteringHttpsAgent block requests to private IPs, but the blocking happens via a synchronous throw inside createConnection() for literal private-IP hostnames (e.g. 169.254.169.254, 127.0.0.1). Node.js's http.request / http.get expects createConnection to emit an error asynchronously; a synchronous throw instead escapes the caller's req.on('error', …) handler entirely and becomes an unhandled exception that crashes the process.

2025

request-filtering-agent SSRF Bypass via HTTPS Requests to 127.0.0.1

request-filtering-agent versions 1.x.x and earlier contain a vulnerability where HTTPS requests to 127.0.0.1 bypass IP address filtering, while HTTP requests are correctly blocked. Impact: Vulnerable patterns (requests that should be blocked but are allowed): https://127.0.0.1:443/api https://127.0.0.1:8443/admin Any HTTPS request using direct IP address https://127.0.0.1 This vulnerability primarily affects services using self-signed certificates on 127.0.0.1. Not affected (correctly blocked in all versions): http://127.0.0.1:80/api - HTTP requests are properly blocked https://localhost:443/api - …