{"action":"Upgrade request-filtering-agent to 3.2.1 or later.","affected":[{"fixed":"3.2.1","introduced":"0"}],"component":"request-filtering-agent","cve_ids":["CVE-2026-62985"],"ecosystem":"npm","epss":0.00564,"exploited":false,"fixed_versions":["3.2.1"],"ghsa_id":"GHSA-r3r9-wp5j-pq5g","id":"tcs_01M5KG7SQVRR97KXZ7QQQ429F0","modified_at":"2026-09-22T20:00:05.170933615Z","published_at":"2026-09-22T19:54:18Z","references":["https://osv.dev/vulnerability/GHSA-r3r9-wp5j-pq5g","https://github.com/azu/request-filtering-agent/security/advisories/GHSA-r3r9-wp5j-pq5g","https://github.com/azu/request-filtering-agent/commit/9d12561064524807fc399158eaa5bd7a40dd8cd0","https://github.com/azu/request-filtering-agent","https://github.com/azu/request-filtering-agent/releases/tag/v3.2.1"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-r3r9-wp5j-pq5g","url":"https://osv.dev/vulnerability/GHSA-r3r9-wp5j-pq5g"}],"summary":"request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process"}