{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3arequest-filtering-agent_projectrequest-filtering-agent/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:request-filtering-agent_project:request-filtering-agent:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-62985"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["request-filtering-agent (\u003c= 3.2.0)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["request-filtering-agent"],"content_html":"\u003cp\u003eThe request-filtering-agent library (versions \u0026lt;= 3.2.0) is susceptible to a denial-of-service (DoS) attack due to improper error handling within its connection logic. The library is intended to block requests to private IP addresses; however, when an application initiates an HTTP request to a literal private IP (e.g., 169.254.169.254 or 127.0.0.1), the library's createConnection() method performs a synchronous throw.\u003c/p\u003e\n\u003cp\u003eIn the Node.js runtime, http.request and http.get expect connection failures to be emitted asynchronously via the 'error' event on the request object. Because the library's error is thrown synchronously, it escapes the application's 'error' event handler, triggering an unhandled exception that crashes the Node.js process. This vulnerability (CVE-2026-62985) allows attackers who can influence the hostname parameter of outgoing HTTP requests to force a persistent process-level DoS, impacting any service relying on the library for request filtering.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in a total denial of service for the affected Node.js process. Any application using request-filtering-agent that processes user-supplied input to perform outbound HTTP requests is at risk. If an attacker identifies an endpoint where they can control or manipulate a destination hostname, they can trigger the synchronous exception to crash the backend service, leading to service disruption and potential availability loss for downstream users.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade request-filtering-agent to version 3.2.1 or later to resolve the handling of synchronous errors.\u003c/li\u003e\n\u003cli\u003eImplement global 'uncaughtException' and 'unhandledRejection' handlers as a secondary defensive layer to catch and log unexpected crashes in Node.js processes.\u003c/li\u003e\n\u003cli\u003eValidate and sanitize all user-supplied input used to construct outbound HTTP requests before passing them to the request-filtering-agent.\u003c/li\u003e\n\u003cli\u003ePerform a code review of components utilizing request-filtering-agent to ensure they are not directly exposed to user-controlled literal IP inputs.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-23T01:59:10Z","date_published":"2026-09-23T01:59:10Z","id":"https://feed.craftedsignal.io/briefs/2026-09-request-filtering-agent-dos/","summary":"A vulnerability in request-filtering-agent causes an unhandled exception and subsequent Node.js process crash when an HTTP request is made to a literal private IP address.","title":"Denial of Service in request-filtering-agent via Synchronous Exception","url":"https://feed.craftedsignal.io/briefs/2026-09-request-filtering-agent-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:request-Filtering-Agent_project:request-Filtering-Agent:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}