Executive brief
Axios is an HTTP client library used in Node.js applications to make web requests. When a developer configures no_proxy to prevent requests to certain hosts (such as internal metadata services), the library fails to recognize equivalent IP addresses and hostnames, allowing an attacker to bypass the proxy exclusion list by using an alternative form of the same address. This could enable server-side request forgery (SSRF) attacks that leak sensitive internal data.
Technical details
The vulnerability is a string-matching bypass in the shouldBypassProxy() function that does not normalize or resolve IP aliases and loopback equivalents. When no_proxy=localhost is configured, requests to 127.0.0.1 or [::1] still route through the configured HTTP proxy instead of bypassing it. Similarly, no_proxy=127.0.0.1 does not block localhost or [::1]. An attacker who can influence request URLs in a server-side environment can exploit this by using an alternative IP alias for a restricted host, routing the request through an attacker-controlled proxy to exfiltrate data from internal services. The fix requires resolving loopback aliases so that localhost, 127.0.0.1, and ::1 are treated as equivalent. Patches are available in Axios 1.15.1 and 0.31.1.
Affected products
- axios axios <=1.15.0, <=0.31.0
Timeline
- 2026-04-24: disclosed
- 2026-04-24: patched: Patches released in versions 1.15.1 and 0.31.1