GHSA-r3r9-wp5j-pq5g request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

• npm request-filtering-agent: < 3.2.1 → fixed in 3.2.1

Summary `RequestFilteringHttpAgent` / `RequestFilteringHttpsAgent` block requests to private IPs, but the blocking happens via a synchronous `throw` inside `createConnection()` for literal private-IP hostnames (e.g. `169.254.169.254`, `127.0.0.1`). Node.js's `http.request` / `http.get` expects `createConnection` to emit an error asynchronously; a synchronous throw instead escapes the caller's `req.on('error', ...)` handler entirely and becomes an unhandled exception that crashes the process. Affected `request-filtering-agent` { console.log('CRASH:', e.message); // fires — process dies }); const req = http.get({ hostname: '169.254.169.254', port: 80, agent }); req.on('error', e => { /* never reached for literal IPs */ }); ``` Actual output: ``` [email protected] synchronous throw escaping error event: UNCAUGHT EXCEPTION (process crash): DNS lookup 169.254.169.254(...) is not allowed. Because, It is private IP address. • CRASH CONFIRMED: createConnection throws sync, bypasses req.on("error") * ``` Note: hostnames that resolve to private IPs (e.g. `localhost`) are handled via the async lookup path and correctly emit an error event — this asymmetry confirms the sync-throw is a defect. Impact Any application using `request-filtering-agent` where an attacker can trigger an HTTP request to a literal private-IP (e.g. from a user-supplied URL that is pre-validated but still reaches `http.get`) will crash the Node.js process — full DoS. Fix Instead of throwing synchronously in `createConnection()`, call `callback(error)` (the Node.js `net.createConnection` error-callback convention) or use `process.nextTick(() => socket.destroy(error))` on the returned socket to emit the error asynchronously, allowing `req.on('error')` to handle it.