CVE-2025-62718

216.73.216.233

· Published 09/04/2026 15:16 · Modified 09/04/2026 17:16

Labels: CVE-2025-62718 2026-04-09 CVE-2025-62718 CWE-441 [email protected]

Essential information

Published: 09/04/2026 15:16
Modified: 09/04/2026 17:16
Author: —
Creator: —
CVSS: 9.3 CRITICAL (v3) 9.3 CRITICAL (v4.0)
CISA KEV: No
CWE: —
CVSS vector: —

CVSS metrics

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0.

NVD status

Status: Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
axios / axios	`cpe:2.3:a:axios:axios:<1.15.0:::::::*`
axios / axios	`cpe:2.3:a:axios:axios:1.15.0:::::::*`