The request-filtering-agent intercepts HTTP(S) connections and blocks requests to private or reserved IP addresses. In versions prior to 3.2.1, the Agent performed a synchronous throw inside createConnection when rejecting a literal private‑IP host such as 169.254.169.254 or 127.0.0.1. Node.js http.request and http.get routines expect failures to be reported asynchronously via the request's error event; because the exception was thrown synchronously, it bypassed the error handler and terminated the process as an uncaught exception. This incomplete exception handling is identified by CWE‑248 and results in a denial‑of‑service condition for any application that uses the Agent and receives a request to a literal private‑IP host.

The vulnerability affects the azu request-filtering-agent package in all releases before version 3.2.1. Applications that depend on this package to block private‑IP traffic are at risk. The issue is not present in releases 3.2.1 and later, which patch the synchronous throw behavior.

The CVSS score is 7.5, indicating high severity, while the EPSS score is not available and the vulnerability is not listed in CISA KEV. The likely attack vector is a remote attacker sending an HTTP request that, when processed by an application using request-filtering-agent, includes a literal private‑IP host. Because the exception is synchronous, the attack will immediately terminate the Node.js process, causing a denial‑of‑service. The vulnerability is exploitable as long as the application uses the affected Agent and does not perform additional validation or use an alternate error handling mechanism.