Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
RequestFilteringHttpAgent / RequestFilteringHttpsAgent block requests to private IPs, but the blocking happens via a synchronous throw inside createConnection() for literal private-IP hostnames (e.g. 169.254.169.254, 127.0.0.1). Node.js's http.request / http.get expects createConnection to emit an error asynchronously; a synchronous throw instead escapes the caller's req.on('error', ...) handler entirely and becomes an unhandled exception that crashes the process. Affected request-filtering-agent <= 3.2.0 (latest). PoC (replicated live on 3.2.0) Actual output: Note: hostnames that resolve to private IPs (e.g. localhost) are handled via the async lookup path and correctly emit an error event — this asymmetry confirms the sync-throw is a defect. Impact Any application using request-filtering-agent where an attacker can trigger an HTTP request to a literal private-IP (e.g. from a user-supplied URL that is pre-validated but still reaches http.get) will crash the Node.js process —…
Recommended action: Upgrade to 3.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
request-filtering-agent versions 1.x.x and earlier contain a vulnerability where HTTPS requests to 127.0.0.1 bypass IP address filtering, while HTTP requests are correctly blocked. Impact: Vulnerable patterns (requests that should be blocked but are allowed): - https://127.0.0.1:443/api - https://127.0.0.1:8443/admin - Any HTTPS request using direct IP address https://127.0.0.1 This vulnerability primarily affects services using self-signed certificates on 127.0.0.1. Not affected (correctly blocked in all versions): - http://127.0.0.1:80/api - HTTP requests are properly blocked - https://localhost:443/api - Domain-based requests trigger DNS lookup and are blocked - http://localhost:80/api - Domain-based HTTP requests are blocked - Requests to other private IPs like 192.168.x.x, 10.x.x.x, 172.16.x.x This allows attackers to potentially access internal HTTPS services running on localhost, bypassing the library's SSRF protection. The vulnerability is particularly dangerous when the…
Recommended action: Upgrade to 2.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.