Skip to main content

Axios EUVDEUVD-2025-209381

| CVE-2025-62718 MEDIUM
Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441)
2026-04-09 GitHub_M GHSA-3p68-rc4w-qgx5
SSRF Node.js Axios
Medium
Disputed · 6.3 Vendor: GitHub_M
View

Vulnerability Assessment

Weakness
CWE
CWE-441
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service Proxy/intermediary controls
Impact

CVSS 9.3 with unauthenticated network-based exploitation reflects critical severity: hostname normalization bypass allows attackers to circumvent NO_PROXY protections, forcing requests through proxies to reach loopback/internal services. High confidentiality impact outweighs partial integrity/availability effects. Node.js/browser HTTP clients are pervasively deployed; exploitation automatable per SSVC. Patch availability (1.15.0) enables rapid remediation.
Exploit ScenarioDerived

Attacker crafts HTTP request to malformed hostname (e.g., 'localhost.' or IPv6 literal '[::1]') targeting Node.js/browser Axios client with NO_PROXY configured. Axios normalization flaw causes request routing through configured proxy instead of bypassing it, enabling SSRF to internal services. POC code exists in GitHub advisory.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 09, 2026

Hostname normalization bypass in Axios (JavaScript HTTP client) versions prior to 1.15.0 allows unauthenticated remote attackers to circumvent NO_PROXY configuration rules and force HTTP requests through configured proxies. Attackers can exploit malformed loopback addresses (localhost. with trailing dot, [::1] IPv6 literals) to bypass proxy restrictions and conduct Server-Side Request Forgery (SSRF) attacks against protected internal services. Publicly available exploit code exists. Affects all Axios implementations in Node.js and browser environments with NO_PROXY configurations.

RemediationAI

Vendor-released patch: Upgrade to Axios 1.15.0 immediately. The fix implements RFC-compliant hostname normalization before NO_PROXY matching (commit fb3befb6daac6cad26b2e54094d0f2d9e47f24df). Advisory URL: https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5. For environments unable to upgrade immediately, implement strict network egress controls at firewall/infrastructure layer to block proxy access to loopback/RFC1918 addresses. Review all NO_PROXY configurations and validate that critical internal services are not accessible via proxy routes. Avoid reliance on application-layer NO_PROXY rules as sole SSRF protection until patched.

Affected VersionsENISA

axios < 1.15.0

Affected Packages

npm axios fix: 0.31.0, 1.15.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Root cause is CWE-441 (Unintended Proxy or Intermediary) in Axios proxy bypass logic. The library fails to canonicalize hostnames per RFC 1034/3986 before matching NO_PROXY rules. Non-normalized loopback representations (trailing dots in DNS names, IPv6 bracket notation) evade string-based NO_PROXY filters, routing requests through proxies despite developer intent to exclude localhost/internal ranges.

Know when Axios gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (GitHub_M) PRIMARY 6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
SUSE 9.9 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
Red Hat 7.0 HIGH

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
Low
Vulnerable system: Integrity
Low
Vulnerable system: Availability
None
Subsequent system: Confidentiality
Low
Subsequent system: Integrity
Low
Subsequent system: Availability
None

Lifecycle Timeline

4
Severity Changed
Apr 16, 2026 - 19:22 NVD
CRITICAL MEDIUM
CVSS changed
Apr 16, 2026 - 19:22 NVD
9.3 (CRITICAL) 6.3 (MEDIUM)
Patch released
Apr 09, 2026 - 20:30 nvd
Patch available
CVE Published
Apr 09, 2026 - 14:31 nvd
CRITICAL 9.3

DescriptionCVE.org

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 273 npm packages depend on axios (189 direct, 84 indirect)

Ecosystem-wide dependent count for version 1.0.0.

Executive ViewAI

Why It Matters

Axios versions before 1.15.0 contain a critical hostname normalization flaw that allows unauthenticated attackers to bypass proxy exclusion rules and force traffic through corporate proxies, enabling Server-Side Request Forgery attacks against internal systems. Any application using Axios with NO_PROXY configurations-particularly Node.js backend services and web applications handling sensitive internal communications-faces immediate risk of unauthorized access to protected resources.

Business Impact: Severe
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable NO_PROXY configuration and whitelist only explicitly required internal hosts using proxy-level rules; (2) Implement network-layer restrictions blocking direct access to internal services from application containers; (3) Deploy Web Application Firewall rules to detect malformed hostname patterns (trailing dots, IPv6 bracket notation) in request headers; (4) Monitor proxy logs for unusual traffic patterns to internal-only IP ranges; (5) Restrict Axios to allowlisted destinations via application-level filtering until patch is available.

Threat Intelligence Overview

EPSS Score
0.0%
Top 97% exploitable
Threat Intel
2
1 sources
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA MAL Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact
Very High
Technical Impact
Partial

Priority Score

52
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Server-Side Request Forgery HIGH

Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.

More in Axios

View all
CVE-2026-42043 CRITICAL POC
10.0 Apr 24

NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a requ
CVE-2026-42044 CRITICAL POC
9.1 Apr 24

JSON response tampering in the Axios HTTP client (versions 1.0.0 up to but not including 1.15.2) lets an attacker who ca
CVE-2026-67320 HIGH POC
8.3 Aug 01

Prototype pollution via the Node.js HTTP adapter in axios allows an attacker who controls `Object.prototype.proxy` to si
CVE-2025-27152 HIGH POC
7.7 Mar 07

axios is a promise based HTTP client for the browser and node.js. Rated high severity (CVSS 7.7), this vulnerability is

CVE-2025-58754 HIGH POC
7.5 Sep 12

Axios is a promise based HTTP client for the browser and Node.js. Rated high severity (CVSS 7.5), this vulnerability is

CVE-2026-25639 HIGH POC
7.5 Feb 09

Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
CVE-2024-39338 HIGH POC
7.5 Aug 12

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative
CVE-2021-3749 HIGH POC
7.5 Aug 31

axios is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is

CVE-2019-10742 HIGH POC
7.5 May 07

Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to acce
CVE-2026-42033 HIGH POC
7.4 Apr 24

Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification

CVE-2026-42039 MEDIUM POC
6.9 Apr 24

Denial of service in Axios HTTP client before versions 1.15.1 and 0.31.1 allows remote unauthenticated attackers to cras
CVE-2026-42041 MEDIUM POC
6.5 Apr 24

Prototype pollution in Axios library versions prior to 1.15.1 and 0.31.1 allows remote attackers to suppress HTTP error

Same weakness CWE-441 – Unintended Proxy or Intermediary ('Confused Deputy')

View all
CVE-2026-72526 CRITICAL
9.9
CVE-2026-70398 CRITICAL
9.6
CVE-2026-42933 CRITICAL
10.0
CVE-2019-3924 HIGH POC
7.5
CVE-2020-5412 MEDIUM POC
6.5
CVE-2019-3996 MEDIUM POC
6.5
CVE-2026-16158 CRITICAL
10.0
CVE-2026-102255 CRITICAL POC
10.0

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-22054 HIGH POC
7.5
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 12 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:8483 ADVISORY https://access.redhat.com/errata/RHSA-2026:8484 ADVISORY https://access.redhat.com/errata/RHSA-2026:8490 ADVISORY https://access.redhat.com/errata/RHSA-2026:8491 ADVISORY https://access.redhat.com/errata/RHSA-2026:8493 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-62718 ADVISORY https://ubuntu.com/security/notices/USN-8638-1 ADVISORY https://vuldb.com/vuln/356581 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2025-62718 REF https://access.redhat.com/errata/RHSA-2026:10175 REF https://access.redhat.com/errata/RHSA-2026:13571 REF https://access.redhat.com/errata/RHSA-2026:13826 REF https://access.redhat.com/errata/RHSA-2026:14937 REF https://access.redhat.com/errata/RHSA-2026:16874 REF https://access.redhat.com/errata/RHSA-2026:17657 REF https://access.redhat.com/errata/RHSA-2026:17699 REF https://access.redhat.com/errata/RHSA-2026:19375 REF https://access.redhat.com/errata/RHSA-2026:19712 REF https://access.redhat.com/errata/RHSA-2026:20889 REF https://access.redhat.com/errata/RHSA-2026:20938 REF https://access.redhat.com/errata/RHSA-2026:21017 REF https://access.redhat.com/errata/RHSA-2026:22465 REF https://access.redhat.com/errata/RHSA-2026:22629 REF https://access.redhat.com/errata/RHSA-2026:22840 REF https://access.redhat.com/errata/RHSA-2026:23361 REF https://access.redhat.com/errata/RHSA-2026:24471 REF https://access.redhat.com/errata/RHSA-2026:24761 REF https://access.redhat.com/errata/RHSA-2026:24766 REF https://access.redhat.com/errata/RHSA-2026:24853 REF https://access.redhat.com/errata/RHSA-2026:24866 REF https://access.redhat.com/errata/RHSA-2026:24977 REF https://access.redhat.com/errata/RHSA-2026:26010 REF https://access.redhat.com/errata/RHSA-2026:36882 REF https://access.redhat.com/errata/RHSA-2026:41928 REF https://access.redhat.com/errata/RHSA-2026:59155 REF https://access.redhat.com/errata/RHSA-2026:9742 REF https://access.redhat.com/security/cve/CVE-2025-62718 REF https://bugzilla.redhat.com/show_bug.cgi?id=2456913 REF https://datatracker.ietf.org/doc/html/rfc1034#section-3.1 REF https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2 REF https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c REF https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df REF https://github.com/axios/axios/pull/10661 REF https://github.com/axios/axios/pull/10688 REF https://github.com/axios/axios/releases/tag/v0.31.0 REF https://github.com/axios/axios/releases/tag/v1.15.0 REF https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5 REF https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-62718.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy