Junglewise Threat Intelligence

CVE-2025-62718: Axios hostname normalization proxy bypass and SSRF

CVE-2025-62718 · Severity: critical · CVSS 9.9 · Published 2026-04-09

Technologies: Axios. Vendors: Axios.

Executive brief

Axios, a popular HTTP client library used in Node.js and browser applications, fails to normalize hostnames when checking NO_PROXY rules. This allows attackers to bypass proxy protections by using alternative hostname formats (like "localhost." with a trailing dot or IPv6 literals), forcing requests to internal loopback services through an attacker-controlled proxy and enabling potential data exfiltration from internal services.

Technical details

The vulnerability is a hostname normalization bypass in Axios's NO_PROXY evaluation logic (CWE-918, CWE-441). Axios performs literal string comparison against NO_PROXY values instead of normalizing hostnames per RFC 1034 and RFC 3986. A fully qualified domain name (FQDN) with a trailing dot (e.g., "localhost.") is DNS-equivalent to "localhost", but Axios treats them as different strings, causing the NO_PROXY check to fail. Similarly, IPv6 addresses in bracket notation ([::1]) are not normalized for matching. An attacker controlling request URLs can craft alternate hostname formats that bypass NO_PROXY rules, forcing Axios to route local traffic through a proxy under the attacker's control. This defeats SSRF mitigations and enables exfiltration of sensitive responses from internal services. The vulnerability affects Axios versions ≥1.0.0 and <1.15.0, as well as ≥0.0.0 and <0.31.0. Patches are available in versions 1.15.0+ and 0.31.0+.

Affected products

  • axios axios >=1.0.0 <1.15.0, >=0.0.0 <0.31.0

Timeline

  • 2026-04-09: disclosed: Advisory GHSA-3p68-rc4w-qgx5 published
  • 2026-04-06: patched: Fix merged for v1.x branch (PR #10661)
  • 2026-04-11: patched: Backport merged for v0.x branch (PR #10688)

References

Related threats