EUVD-2026-25604
GHSA-m7pr-hjqh-92cm
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6Blast Radius
ecosystem impact- 273 npm packages depend on axios (189 direct, 84 indirect)
Ecosystem-wide dependent count for version 1.0.0.
DescriptionGitHub Advisory
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching - it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.
AnalysisAI
Axios versions prior to 1.15.1 and 0.31.1 fail to properly bypass proxy configurations when no_proxy=localhost is set, allowing attackers to route requests to loopback addresses (127.0.0.1 and [::1]) through proxy servers instead of bypassing them. This Server-Side Request Forgery (SSRF) vulnerability arises because the shouldBypassProxy() function performs only string matching without resolving IP aliases or loopback equivalents, potentially exposing internal services to proxy interception or manipulation with a CVSS score of 6.8 (high confidentiality impact over changed scope).
Technical ContextAI
Axios is a promise-based HTTP client library for both browser and Node.js environments. The vulnerability exists in the proxy bypass logic that evaluates whether a target hostname should skip proxy routing based on the no_proxy configuration parameter. The root cause is improper hostname normalization (CWE-918, Server-Side Request Forgery) where the shouldBypassProxy() function relies on literal string comparison rather than semantic equivalence. When a developer configures no_proxy=localhost to bypass the proxy for local connections, the function fails to recognize that 127.0.0.1 (IPv4 loopback) and [::1] (IPv6 loopback) are network-layer equivalents of localhost. This is particularly dangerous in Node.js environments where Axios is commonly used in server-side HTTP request libraries for microservice communication, API gateways, and backend integrations.
RemediationAI
Upgrade Axios to version 1.15.1 or later for the 1.x branch, or to version 0.31.1 or later for the 0.x branch. These versions include the corrected hostname normalization logic that properly resolves IP aliases and loopback addresses against the no_proxy configuration. For applications unable to upgrade immediately, implement a workaround by wrapping Axios HTTP calls with custom IP-to-hostname resolution logic that explicitly normalizes loopback addresses (127.0.0.1, ::1, localhost) to a canonical form before proxy evaluation, though this requires application-level code changes and carries the trade-off of increased latency and maintenance burden. Alternatively, enforce proxy bypass at the network layer (e.g., firewall rules, reverse proxy configuration) rather than relying solely on HTTP client library logic, though this reduces flexibility and may not be feasible in all architectures. Review all no_proxy configurations in use to identify where loopback address bypass is critical; prioritize patching those instances first. Consult https://github.com/axios/axios/security/advisories/GHSA-m7pr-hjqh-92cm for detailed upgrade instructions and confirmation of fix completeness.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today