Executive brief
Axios, a popular library for making web requests, contains a flaw in how it handles proxy settings in Node.js environments. When configured to bypass a proxy for local addresses, it fails to recognize '0.0.0.0' as a local address, potentially routing sensitive local traffic through an external proxy server. This could allow an attacker to redirect requests to internal services or bypass security filters designed to protect private infrastructure.
Technical details
The vulnerability exists in the `shouldBypassProxy` helper within `lib/helpers/shouldBypassProxy.js`. The `isLoopback` function fails to include '0.0.0.0' in its check for local loopback addresses, even though many operating systems (Linux/macOS) treat it as such. When an application uses `NO_PROXY` rules for 'localhost' or '127.0.0.1', requests to '0.0.0.0' are incorrectly routed through the `HTTP_PROXY` or `HTTPS_PROXY`. An attacker who can influence the request URL or follow redirects can exploit this to bypass SSRF protections or expose internal service responses to the proxy. This issue affects the Node.js HTTP adapter only.
Affected products
- Axios axios >= 1.15.0, < 1.18.0
- Axios axios >= 0.31.0, < 0.33.0
Timeline
- 2026-07-06: disclosed: Initial publication of the advisory.
- 2026-07-20: advisory: Advisory updated.
- 2026-07-20: patched: Fixed in versions 1.18.0 and 0.33.0.