EUVD-2026-51829
GHSA-6hqm-hm2v-3p2p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the four mandatory preconditions; S:C and C:H capture local service confidentiality exposure through the proxy relay.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.
AnalysisAI
NO_PROXY bypass in axios Node.js HTTP client exposes local services to configured proxies when requests target 0.0.0.0. Affected versions 1.15.0-1.17.x and 0.31.0-0.32.x omit 0.0.0.0 from loopback address recognition in shouldBypassProxy.js, causing traffic intended to bypass proxy routing to instead be forwarded through HTTP_PROXY or HTTPS_PROXY. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all five of the following conditions simultaneously: (1) axios is running in Node.js using the HTTP adapter - not in a browser, React Native, or fetch-based context; (2) the process environment has HTTP_PROXY or HTTPS_PROXY set to a reachable proxy; (3) NO_PROXY is configured with canonical loopback entries such as localhost, 127.0.0.1, or ::1 but does not explicitly include 0.0.0.0; (4) an attacker can influence the URL supplied to axios, whether through direct user input, attacker-controlled redirects, or injected configuration; (5) the configured proxy can reach or relay traffic to 0.0.0.0 on the host and does not itself block such destinations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 6.9 is driven by AV:N/AC:L/AT:P/PR:N/UI:N with subsequent-system confidentiality impact SC:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a crafted URL containing http://0.0.0.0:<port>/ to a Node.js application that accepts user-controlled URLs and uses axios to fetch them - for example, a server-side rendering service or webhook tester. Because axios does not classify 0.0.0.0 as a loopback address, the request is routed through the application's configured HTTP proxy rather than being sent directly and blocked by NO_PROXY rules. … |
| Remediation | Upgrade axios to 1.18.0 (for users on the 1.x line) or 0.33.0 (for users on the 0.x line); these are the confirmed fixed versions per the upstream GitHub advisory at https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a requ
JSON response tampering in the Axios HTTP client (versions 1.0.0 up to but not including 1.15.2) lets an attacker who ca
axios is a promise based HTTP client for the browser and node.js. Rated high severity (CVSS 7.7), this vulnerability is
Axios is a promise based HTTP client for the browser and Node.js. Rated high severity (CVSS 7.5), this vulnerability is
Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative
axios is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to acce
Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification
Denial of service in Axios HTTP client before versions 1.15.1 and 0.31.1 allows remote unauthenticated attackers to cras
Prototype pollution in Axios library versions prior to 1.15.1 and 0.31.1 allows remote attackers to suppress HTTP error
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it i
Same weakness CWE-183 – Permissive List of Allowed Inputs
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today