What is CVE-2025-57814?

CVE-2025-57814 is a medium-severity server-side request forgery (SSRF) vulnerability in request-filtering-agent (npm), affecting versions < 2.0.0. It is fixed in 2.0.0. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.

Which versions of request-filtering-agent are affected by CVE-2025-57814?

request-filtering-agent (npm) versions < 2.0.0 is affected.

Is there a fix for CVE-2025-57814?

Yes. CVE-2025-57814 is fixed in 2.0.0. Upgrade to this version or later.

Is CVE-2025-57814 exploitable, and should I be worried?

Whether CVE-2025-57814 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2025-57814 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

CVE-2025-57814 in request-filtering-agent

Q: Which versions of request-filtering-agent are affected by CVE-2025-57814?

request-filtering-agent (npm) versions < 2.0.0 is affected.

Q: Is there a fix for CVE-2025-57814?

Yes. CVE-2025-57814 is fixed in 2.0.0. Upgrade to this version or later.

Q: Is CVE-2025-57814 exploitable, and should I be worried?

Whether CVE-2025-57814 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2025-57814 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2025-57814?

Upgrade request-filtering-agent to 2.0.0 or later.

Summary

request-filtering-agent SSRF Bypass via HTTPS Requests to 127.0.0.1

request-filtering-agent versions 1.x.x and earlier contain a vulnerability where HTTPS requests to 127.0.0.1 bypass IP address filtering, while HTTP requests are correctly blocked.

Impact:

Vulnerable patterns (requests that should be blocked but are allowed):

https://127.0.0.1:443/api
https://127.0.0.1:8443/admin
Any HTTPS request using direct IP address https://127.0.0.1

This vulnerability primarily affects services using self-signed certificates on 127.0.0.1.

Not affected (correctly blocked in all versions):

http://127.0.0.1:80/api - HTTP requests are properly blocked
https://localhost:443/api - Domain-based requests trigger DNS lookup and are blocked
http://localhost:80/api - Domain-based HTTP requests are blocked
Requests to other private IPs like 192.168.x.x, 10.x.x.x, 172.16.x.x

This allows attackers to potentially access internal HTTPS services running on localhost, bypassing the library's SSRF protection. The vulnerability is particularly dangerous when the application accepts user-controlled URLs and internal services are only protected by network-level restrictions.

Fixed in 2.0.0

This vulnerability has been fixed in request-filtering-agent version 2.0.0. Users should upgrade to version 2.0.0 or later.

Root Cause:The HTTPS agent fails to validate direct IP addresses like https://127.0.0.1 during TLS connection setup, allowing them to bypass the security filter.

Details: https://github.com/azu/request-filtering-agent-https127-test

Thanks Luca

Impact

Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside. Typical impact: access to internal metadata services, internal APIs, or cloud credentials.

Affected versions

request-filtering-agent (< 2.0.0)

Security releases

request-filtering-agent → 2.0.0 (npm)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Upgrade request-filtering-agent to 2.0.0 or later to resolve this vulnerability.

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

What is CVE-2025-57814? CVE-2025-57814 is a medium-severity server-side request forgery (SSRF) vulnerability in request-filtering-agent (npm), affecting versions < 2.0.0. It is fixed in 2.0.0. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.
Which versions of request-filtering-agent are affected by CVE-2025-57814? request-filtering-agent (npm) versions < 2.0.0 is affected.
Is there a fix for CVE-2025-57814? Yes. CVE-2025-57814 is fixed in 2.0.0. Upgrade to this version or later.
Is CVE-2025-57814 exploitable, and should I be worried? Whether CVE-2025-57814 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2025-57814 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2025-57814? Upgrade request-filtering-agent to 2.0.0 or later.