Proxy Bypass in Axios HTTP Client Affects Internal Connections

CVE-2025-62718

What is CVE-2025-62718?

Axios, a promise-based HTTP client for browser and Node.js, contains a vulnerability where it improperly handles hostname normalization in relation to NO_PROXY rules. Prior to version 1.15.0, requests made to loopback addresses—such as 'localhost.' (with a trailing dot) or the IPv6 literal '[::1]'—would bypass NO_PROXY configurations. As a result, this misconfiguration could allow attackers to force requests through a proxy even though safeguards were meant to prevent access to sensitive loopback or internal services. This flaw poses significant security risks, making it imperative for developers to upgrade to version 1.15.0 or later.

References