CVE-2025-62718: 
JavaScript vulnerability analysis and mitigation

CVE-2025-62718 is a NO_PROXY hostname normalization bypass vulnerability in the Axios HTTP client library for Node.js that enables Server-Side Request Forgery (SSRF) attacks. Axios performs a literal string comparison instead of normalizing hostnames before evaluating NO_PROXY rules, causing requests to loopback addresses using a trailing dot (e.g., localhost.) or bracketed IPv6 literals (e.g., [::1]) to bypass NO_PROXY matching and be routed through a configured proxy. The vulnerability affects Axios versions >=1.0.0 <1.15.0 and <0.31.0 for Node.js. It was published on April 9, 2026, with fixes released the same day. The CVSS v3.1 base score is 9.9 (Critical) per NVD, while the GitHub Advisory assigns a CVSS v4 score of 6.3 (Medium) (Github Advisory, Axios Security Advisory).

The root cause is improper hostname normalization (CWE-441: Unintended Proxy or Intermediary; CWE-918: Server-Side Request Forgery) in Axios's Node.js HTTP adapter. Per RFC 1034 §3.1 and RFC 3986 §3.2.2, a trailing dot on a hostname denotes a fully qualified domain name (FQDN), making localhost. semantically equivalent to localhost at the DNS level. However, Axios compared hostnames literally against NO_PROXY entries, so localhost. and [::1] (with brackets) did not match the expected entries localhost and ::1, causing those requests to be incorrectly forwarded to the configured proxy. The fix introduced a new shouldBypassProxy helper (lib/helpers/shouldBypassProxy.js) that strips trailing dots and removes brackets from IPv6 literals before matching against NO_PROXY entries, and integrated it into the Node HTTP adapter (Axios PR #10661, Axios Commit fb3befb). A public proof-of-concept demonstrating the bypass is included in the official security advisory (Axios Security Advisory).

Successful exploitation allows an unauthenticated network attacker to force Axios-based applications to route HTTP requests intended for loopback or internal services through an attacker-controlled proxy, bypassing SSRF mitigations that rely on NO_PROXY rules. This can result in exfiltration of sensitive responses from internal services (confidentiality impact), unauthorized modification of data on internal services (integrity impact), and potential disruption of internal service availability. The scope change in the CVSS scoring reflects that the impact extends beyond the vulnerable Axios component to downstream internal systems and services that were intended to be protected by NO_PROXY configuration (Github Advisory, Axios Security Advisory).

A complete, runnable proof-of-concept exploit is publicly available in the official Axios security advisory, demonstrating the bypass by setting up a local proxy server and showing how Axios incorrectly routes requests through it when NO_PROXY rules should block them (Axios Security Advisory). The EPSS score is approximately 0.069% (21st percentile), indicating a relatively low but non-negligible probability of exploitation in the wild within 30 days. No specific threat actor attribution or confirmed in-the-wild exploitation campaigns have been reported, and the vulnerability is not currently listed in the CISA KEV catalog. The vulnerability requires no authentication and no user interaction, making it straightforward to exploit in environments where an attacker can influence the URLs passed to Axios (Github Advisory).

1. Identify a target application: Find a Node.js application using Axios (versions <1.15.0 or <0.31.0) that makes HTTP requests to user-influenced or attacker-influenced URLs, and that relies on NO_PROXY=localhost,127.0.0.1,::1 (or similar) to protect loopback/internal services.
2. Set up or identify a proxy: Position an attacker-controlled HTTP proxy (e.g., a simple Node.js http.createServer listener or Burp Suite) that can intercept proxied traffic.
3. Craft a bypass URL: Construct a request URL targeting a loopback or internal service using a trailing dot on the hostname (e.g., http://localhost.:8080/admin) or a bracketed IPv6 literal (e.g., http://[::1]:8080/secret).
4. Trigger the Axios request: Cause the vulnerable application to make an Axios GET/POST request to the crafted URL — for example, by supplying the URL as user input, via a webhook, or through another injection point.
5. Intercept proxied traffic: Because Axios fails to normalize the hostname before checking NO_PROXY, the request bypasses the NO_PROXY rule and is forwarded to the configured proxy. The attacker's proxy receives the full request, including any sensitive headers or response data from the internal service.
6. Exfiltrate or manipulate data: Read sensitive responses from internal services (e.g., metadata endpoints, admin APIs, internal databases) relayed through the proxy, or relay modified responses back to the application (Axios Security Advisory, Github Advisory).

• Network: Outbound HTTP CONNECT or GET requests from the application server to an unexpected proxy IP/port, particularly for requests targeting localhost., 127.0.0.1, or [::1]; proxy access logs showing requests with Host: localhost. or Host: [::1] headers.
• Logs: Application logs showing Axios requests to loopback addresses being routed through a proxy rather than directly; Node.js HTTP adapter logs indicating proxy usage for localhost. or [::1] destinations.
• Network: Unexpected outbound connections from the Node.js application process to external or internal proxy addresses when requests to loopback services are made; traffic to internal metadata endpoints (e.g., http://169.254.169.254/) routed through a proxy.
• File System: Presence of Axios versions <1.15.0 or <0.31.0 in node_modules/axios/package.json on affected systems.

Upgrade Axios to version 1.15.0 (for the 1.x branch) or 0.31.0 (for the 0.x branch), which introduce proper hostname normalization before NO_PROXY evaluation (Axios v1.15.0 Release, Github Advisory). As a workaround prior to patching, implement network-level controls (e.g., firewall rules, egress filtering) to prevent the application server from connecting to attacker-controlled proxies, and restrict outbound proxy traffic to authorized destinations only. Additionally, review and audit all NO_PROXY configurations to ensure they are functioning correctly after patching, and consider implementing network segmentation to limit the blast radius of any SSRF exploitation. IBM has issued multiple security bulletins for affected products including App Connect Enterprise, Aspera Faspex, SPSS Collaboration and Deployment Services, API Connect, and many others — consult the relevant IBM advisories for product-specific remediation guidance (IBM Advisory).

The vulnerability received notable community attention shortly after disclosure, trending in CVE watch communities on Reddit and being discussed on social platforms including Bluesky and X (Twitter) (Reddit CVEWatch). Security news outlets including SecurityOnline.info published dedicated coverage of the NO_PROXY bypass (SecurityOnline). IBM issued a large number of security bulletins across its product portfolio acknowledging the impact, reflecting the widespread use of Axios as a dependency in enterprise software. A developer blog post on dev.to described the vulnerability as a "silent SSRF bug" that could be hiding in Node.js applications, highlighting the risk to developers who may not be aware of the NO_PROXY bypass behavior (dev.to). HeroDevs published guidance on safe upgrade paths for Axios in the context of this and related CVEs (HeroDevs).