Executive brief
request-filtering-agent is a Node.js library that blocks HTTP requests to private IP addresses to prevent server-side request forgery (SSRF) attacks. A defect in the library throws errors synchronously instead of asynchronously when blocking literal private-IP hostnames, causing unhandled exceptions that crash the entire Node.js process. Any application using this library can be remotely crashed if an attacker can trigger a request to a private IP address.
Technical details
The RequestFilteringHttpAgent and RequestFilteringHttpsAgent classes block requests to private IPs by throwing errors synchronously within the createConnection() method for literal private-IP hostnames (e.g., 169.254.169.254, 127.0.0.1). Node.js's http.request/http.get expects createConnection() to handle errors asynchronously via callbacks or error events, not synchronous throws. This synchronous throw bypasses the caller's req.on('error', ...) handler entirely and propagates as an unhandled exception, crashing the process. Hostnames that resolve to private IPs (e.g., localhost) are handled via an async DNS lookup path and correctly emit error events, confirming this is a defect. The fix requires calling the error callback or deferring the error via process.nextTick() to allow proper error propagation through req.on('error').
Affected products
- request-filtering-agent request-filtering-agent <=3.2.0
Timeline
- 2026-09-22: disclosed
- 2026-09-22: advisory: GHSA-r3r9-wp5j-pq5g published