CVE-2026-67315

Name of the Vulnerable Software and Affected Versions axios versions 0.31.0 through 0.32.x axios versions 1.15.0 through 1.17.x

Description In Node.js applications using the HTTP adapter, the software fails to recognize 0.0.0.0 as a loopback address within the shouldBypassProxy() function located in lib/helpers/shouldBypassProxy.js. This occurs because the isLoopback() function does not include 0.0.0.0 in its validation logic, causing requests to this address to ignore NO PROXY rules (such as localhost or 127.0.0.1). Consequently, if an attacker can influence the request URL or a redirect target, they can route requests through configured proxies to reach local services, potentially bypassing SSRF filtering and exposing internal admin panels or microservice APIs.

Recommendations Update axios to version 0.33.0 or later. Update axios to version 1.18.0 or later. As a temporary workaround, explicitly add 0.0.0.0 to the NO PROXY environment variable. As a temporary workaround, set proxy: false in the axios request configuration for requests that must not use environment proxies. As a temporary workaround, normalize or reject 0.0.0.0 in application URL validation before passing it to axios. Configure the used proxy to reject requests to 0.0.0.0, loopback, link-local, and internal address ranges.