Executive brief
axios is a popular HTTP client library used in Node.js applications to make web requests. The library has a security feature designed to prevent requests to local addresses from routing through configured proxy servers when NO_PROXY environment variables are set. Versions 0.31.0–0.32.x and 1.15.0–1.17.x fail to recognize 0.0.0.0 as a local address, allowing an attacker who controls a request URL to bypass proxy filtering and reach internal services that the proxy can access, potentially exposing sensitive data or enabling lateral movement in corporate networks.
Technical details
The vulnerability is a permissive allowlist (CWE-183) in the shouldBypassProxy.js helper. The isLoopback() function correctly identifies 127.0.0.0/8 and ::1 as loopback addresses but omits 0.0.0.0, which routes to localhost on Linux and macOS. When an application uses environment proxy variables (HTTP_PROXY, HTTPS_PROXY) with NO_PROXY filters set to localhost,127.0.0.1,::1, a request to http://0.0.0.0:<port>/ will be routed through the proxy instead of bypassing it. Exploitation requires: the app runs axios in Node.js with the HTTP adapter, uses environment proxy variables, sets NO_PROXY entries, and attacker-controlled input can influence the request URL or redirect target. An attacker who supplies a 0.0.0.0 URL can route requests through the proxy to reach local services; for HTTP targets, the proxy sees the full request and response. Patches are available in axios 0.33.0+ and 1.18.0+.
Affected products
- axios axios >=0.31.0, <0.33.0 and >=1.15.0, <1.18.0
Timeline
- 2026-07-06: disclosed: GitHub Security Advisory GHSA-f4gw-2p7v-4548 published
- 2026-08-01: advisory: CVE-2026-67315 published on NVD
- 2026: patched: Fixed in axios 0.33.0 and 1.18.0