# CVE-2025-62718: Axios hostname normalization proxy bypass and SSRF

Source: https://junglewise.ai/threats/cve-2025-62718-axios-hostname-normalization-proxy-bypass-and-ssrf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-62718 · Severity: critical · CVSS 9.9 · Published 2026-04-09

Axios, a popular HTTP client library used in Node.js and browser applications, fails to normalize hostnames when checking NO_PROXY rules. This allows attackers to bypass proxy protections by using alternative hostname formats (like "localhost." with a trailing dot or IPv6 literals), forcing requests to internal loopback services through an attacker-controlled proxy and enabling potential data exfiltration from internal services.

Technologies: [Axios](https://junglewise.ai/threats/technologies/axios). Vendors: [Axios](https://junglewise.ai/threats/vendors/axios).

## Quick answers

**Is CVE-2025-62718 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-62718 being exploited in the wild.

**How severe is CVE-2025-62718?** Critical severity, with a CVSS score of 9.9, published 9 April 2026.

**Which products and versions are affected?** Axios < 1.15.0, < 0.31.0, >= 1.0.0, < 1.15.0; < 0.31.0, >=1.0.0 <1.15.0, >=0.0.0 <0.31.0.

**Is there a fix for CVE-2025-62718?** A patch was published on 2026-04-06: Fix merged for v1.x branch (PR #10661) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-62718 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-62718?** Check whether you run Axios at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a hostname normalization bypass in Axios's NO_PROXY evaluation logic (CWE-918, CWE-441). Axios performs literal string comparison against NO_PROXY values instead of normalizing hostnames per RFC 1034 and RFC 3986. A fully qualified domain name (FQDN) with a trailing dot (e.g., "localhost.") is DNS-equivalent to "localhost", but Axios treats them as different strings, causing the NO_PROXY check to fail. Similarly, IPv6 addresses in bracket notation ([::1]) are not normalized for matching. An attacker controlling request URLs can craft alternate hostname formats that bypass NO_PROXY rules, forcing Axios to route local traffic through a proxy under the attacker's control. This defeats SSRF mitigations and enables exfiltration of sensitive responses from internal services. The vulnerability affects Axios versions ≥1.0.0 and &lt;1.15.0, as well as ≥0.0.0 and &lt;0.31.0. Patches are available in versions 1.15.0+ and 0.31.0+.

## Affected products

- axios axios >=1.0.0 <1.15.0, >=0.0.0 <0.31.0

## Identifiers

- CVE-2025-62718
- GHSA-3p68-rc4w-qgx5

## Timeline

- 2026-04-09: disclosed: Advisory GHSA-3p68-rc4w-qgx5 published
- 2026-04-06: patched: Fix merged for v1.x branch (PR #10661)
- 2026-04-11: patched: Backport merged for v0.x branch (PR #10688)

## References

- [https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5](https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5)
- [https://github.com/axios/axios/pull/10661](https://github.com/axios/axios/pull/10661)
- [https://github.com/axios/axios/pull/10688](https://github.com/axios/axios/pull/10688)
- [https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c](https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c)
- [https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df](https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df)
- [https://datatracker.ietf.org/doc/html/rfc1034](https://datatracker.ietf.org/doc/html/rfc1034)

## Related threats

- [Axios NO_PROXY CIDR notation bypass in Node.js adapter](https://junglewise.ai/threats/cve-2026-101899-axios-cidr-form-no-proxy-entries-are-ignored-causing-proxy)
- [Axios prototype pollution in ToFormData](https://junglewise.ai/threats/cve-2026-101909-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios fetch adapter header injection via prototype pollution](https://junglewise.ai/threats/cve-2026-101908-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios fetch adapter maxRedirects bypass](https://junglewise.ai/threats/cve-2026-101907-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios ReDoS in shouldBypassProxy regular expression](https://junglewise.ai/threats/cve-2026-101906-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)