CVE-2026-62985High· 7.5▾ MidnightPoC availablerequest-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rej…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.7%
Last analysed / modified upstream
Exploit / PoC code exists
request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or 127.0.0.1. Because Node.js http.request and http.get expect connection failures to be delivered asynchronously, the throw bypassed req.on('error') and became an uncaught exception that could terminate the application process. Hostnames resolved through the asynchronous lookup path were not affected by this error-delivery asymmetry. This issue is fixed in version 3.2.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
request-filtering-agent < 3.2.1Patched in:
request-filtering-agent 3.2.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113872High· 7.5multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
CVE-2026-110816Medium· 5.3### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ "toStri…
CVE-2026-107392Medium· 6.2music-metadata is a metadata parser for audio and video media files
CVE-2026-102281High· 7.5Nest is a framework for building scalable Node.js server-side applications
CVE-2026-101901High· 8.2Axios is a promise-based HTTP client for the browser and Node.js
CVE-2026-100722Medium· 6.8vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap