The azu request-filtering-agent's RequestFilteringHttpAgent and RequestFilteringHttpsAgent implementations synchronously threw exceptions from createConnection when rejecting literal private IP addresses (e.g., 169.254.169.254 or 127.0.0.1) prior to version 3.2.1. Node.js http.request and http.get expect connection failures to be delivered asynchronously via error events, so the synchronous throw bypassed the req.on('error') handler and resulted in uncaught exceptions that could crash the application. Hostnames resolved asynchronously were not affected. This flaw is addressed by updating to version 3.2.1.

An attacker or misconfiguration causing the agent to reject a request to a literal private IP address could trigger an uncaught exception, leading to application process termination. This results in a denial of service (DoS) condition. There is no impact on confidentiality or integrity. No known exploits in the wild have been reported.

Upgrade the azu request-filtering-agent to version 3.2.1 or later, where this issue is fixed. No other mitigations are necessary as the fix addresses the root cause by delivering connection failures asynchronously as expected by Node.js.