CVE-2025-62718: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-09 · updated 2026-10-14
Weakness: CWE-441

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0 and 0.31.0.

Summary

Axios fails to normalize hostnames when matching NO_PROXY rules, so requests to loopback addresses such as localhost. (trailing dot) or [::1] bypass NO_PROXY and are sent through the configured proxy. This proxy bypass enables SSRF, letting attackers reach sensitive loopback or internal services despite configured protections. The flaw affects Axios before 1.15.0 and 0.31.0 and is rated critical (CVSS 9.9); a public exploit or detection template exists and CISA SSVC lists proof-of-concept exploitation, though it is not in CISA KEV. Upgrade to Axios 1.15.0 or 0.31.0, and until patched, avoid relying on NO_PROXY alone to protect internal services.

لا يقوم Axios بتطبيع أسماء المضيفين بشكل صحيح عند مطابقة قواعد NO_PROXY، لذا فإن الطلبات الموجهة إلى عناوين loopback مثل localhost. (بنقطة لاحقة) أو [::1] تتجاوز NO_PROXY وتُمرَّر عبر الوكيل المُعدّ. يتيح هذا التجاوز هجمات SSRF تُمكّن المهاجمين من الوصول إلى خدمات loopback أو داخلية حساسة رغم الحمايات المُعدّة. تؤثر الثغرة في Axios قبل الإصدارين 1.15.0 و0.31.0 وتصنَّف حرجة (CVSS 9.9)، ويوجد استغلال عام أو قالب كشف، وتُدرج CISA SSVC استغلالاً إثباتياً، لكنها ليست في CISA KEV. يجب الترقية إلى Axios 1.15.0 أو 0.31.0، وإلى حين الترقية لا يُعتمد على NO_PROXY وحده لحماية الخدمات الداخلية.

Affected products

axios: before 0.31.0; from 1.0.0 before 1.15.0 — fixed in 0.31.0, 1.15.0
Npm Axios: from 1.0.0 before 1.15.0; before 0.31.0 — fixed in 1.15.0, 0.31.0

How to fix

Upgrade to a fixed version: axios 0.31.0, 1.15.0; Npm Axios 1.15.0, 0.31.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-62718 or the next vulnerability affects your stack