CVE-2026-67315 Details
Description
axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.
A vulnerability exists in Axios versions 1.15.0 prior to 1.18.0 and in version 0.31.0 prior to 0.33.0. These versions fail to recognize '0.0.0.0' as a loopback address, allowing requests to '0.0.0.0' to bypass 'NO_PROXY' rules. This issue can be exploited in Node.js applications using the HTTP or HTTPS proxy with 'NO_PROXY' settings that include 'localhost', '127.0.0.1', or '::1'. When the proxy can reach the destination, an attacker can manipulate the request URL to route through the proxy, potentially exposing local services.
Update Axios to version 1.18.0 or later, or to version 0.33.0 or later. If an immediate update is not possible, add '0.0.0.0' to the 'NO_PROXY' variable, reject or normalize '0.0.0.0' in application URL validation before using Axios, or set 'proxy: false' on Axios requests that should not use environment proxies.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548 | [email protected] | ExploitMitigationVendor Advisory |
| https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-183 | Permissive List of Allowed Inputs | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| axios axios | >= 0.31.0, < 0.33.0 >= 1.15.0, < 1.18.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 1, 2026 | Initial Analysis | [email protected] |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 2, 2026 | CVE Modified | [email protected] |
| Aug 1, 2026 | New CVE Received | [email protected] |