EUVD-2026-51829
GHSA-6hqm-hm2v-3p2p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the four mandatory preconditions; S:C and C:H capture local service confidentiality exposure through the proxy relay.
AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4Blast Radius
ecosystem impact- 3,082 npm packages depend on axios (828 direct, 2,280 indirect)
Ecosystem-wide dependent count for version 1.15.0.
DescriptionCVE.org
axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.
AnalysisAI
NO_PROXY bypass in axios Node.js HTTP client exposes local services to configured proxies when requests target 0.0.0.0. Affected versions 1.15.0-1.17.x and 0.31.0-0.32.x omit 0.0.0.0 from loopback address recognition in shouldBypassProxy.js, causing traffic intended to bypass proxy routing to instead be forwarded through HTTP_PROXY or HTTPS_PROXY. Plain HTTP requests are most exposed since the proxy receives the full request URL, headers, and body; HTTPS is partially mitigated by CONNECT tunneling. No public exploit or CISA KEV listing identified at time of analysis, but exploitation requires only attacker-controlled URL input in an otherwise common Node.js proxy deployment.
Technical ContextAI
axios (cpe:2.3:a:axios:axios) is a promise-based HTTP client for Node.js and browsers, among the most widely deployed npm packages. The vulnerability resides in lib/helpers/shouldBypassProxy.js, specifically in the isLoopback() function, which defines loopback equivalence for NO_PROXY matching. The function recognizes localhost, 127.0.0.0/8, ::1, and IPv4-mapped loopback forms, but omits 0.0.0.0. At line 176, axios resolves proxy bypass by checking: return hostname === entryHost || (isLoopback(hostname) && isLoopback(entryHost)). Because isLoopback('0.0.0.0') returns false, a NO_PROXY list containing only canonical loopback entries never matches 0.0.0.0 destinations. Root cause class is CWE-183 (Permissive List of Allowed Inputs): the allowlist of loopback addresses is incomplete. The flaw is strictly a Node.js HTTP adapter issue; browser, fetch, XHR, and React Native adapters are unaffected, and caller-provided config.proxy is also unaffected.
RemediationAI
Upgrade axios to 1.18.0 (for users on the 1.x line) or 0.33.0 (for users on the 0.x line); these are the confirmed fixed versions per the upstream GitHub advisory at https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548. The upstream patches were delivered via pull requests https://github.com/axios/axios/pull/11000 and https://github.com/axios/axios/pull/11001; released package versions 1.18.0 and 0.33.0 are confirmed as incorporating the fix. If immediate upgrade is not feasible, compensating controls include: adding 0.0.0.0 explicitly to the NO_PROXY environment variable (e.g., NO_PROXY=localhost,127.0.0.1,::1,0.0.0.0) to close the bypass gap without code changes; configuring the proxy itself to reject or null-route requests to 0.0.0.0 destinations, which eliminates the relay path even if axios misroutes the request; or validating and rejecting attacker-controlled URLs containing 0.0.0.0 at the application layer before passing them to axios. The NO_PROXY addition is the lowest-risk interim workaround as it requires no code changes and has no side effects on intended traffic.
NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a requ
JSON response tampering in the Axios HTTP client (versions 1.0.0 up to but not including 1.15.2) lets an attacker who ca
Prototype pollution via the Node.js HTTP adapter in axios allows an attacker who controls `Object.prototype.proxy` to si
axios is a promise based HTTP client for the browser and node.js. Rated high severity (CVSS 7.7), this vulnerability is
Axios is a promise based HTTP client for the browser and Node.js. Rated high severity (CVSS 7.5), this vulnerability is
Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative
axios is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to acce
Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification
Denial of service in Axios HTTP client before versions 1.15.1 and 0.31.1 allows remote unauthenticated attackers to cras
Prototype pollution in Axios library versions prior to 1.15.1 and 0.31.1 allows remote attackers to suppress HTTP error
Same weakness CWE-183 – Permissive List of Allowed Inputs
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP3 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP5 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today