CVE-2025-62718

Name of the Vulnerable Software and Affected Versions Axios versions prior to 0.31.0 Axios versions prior to 1.15.0

Description Axios does not correctly handle hostname normalization when checking NO PROXY rules. Because the software performs a literal string comparison instead of normalizing hostnames, requests to loopback addresses such as localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO PROXY matching and are sent through the configured proxy. This behavior allows attackers to force requests through a proxy even when protections are in place for loopback or internal services, leading to proxy bypass and Server-Side Request Forgery (SSRF). SSRF is a flaw where an attacker can induce a server-side application to make requests to an unintended location. There are reports that this issue is under active exploitation to manipulate server requests and expose sensitive data.

Recommendations Update to version 0.31.0 or later. Update to version 1.15.0 or later. Implement strict input validation for request URLs. As a temporary mitigation, normalize hostnames by stripping trailing dots and removing brackets from IPv6 literals before they are processed by the client.