CVE catalog

CVE-2025-62718

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback

[CVE catalog]

Severity
High · CVSS 7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
1.19% · Oct 25, 2026

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0 and 0.31.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-axiossid1.20.0-1fixed
Debiannode-axiosforky1.20.0-1fixed
Debiannode-axiostrixie1.8.4+dfsg-1vulnerable
Debiannode-axiosbookworm1.2.1+dfsg-1+deb12u1vulnerable
Cpenode-axiosNot reportedNot reportedvulnerable
CpeaxiosNot reported0.31.0fixed
CpeaxiosNot reported1.15.0fixed
NpmaxiosNot reported0.31.0fixed
NpmaxiosNot reported0.31.0fixed
Ubuntunode-axiosnoble1.6.8+dfsg-2ubuntu0.1~esm1fixed
CpeaxiosNot reported1.15.0fixed
Ubuntunode-axiospro1.11.0+dfsg-1vulnerable
Ubuntunode-axiospro1.12.1+dfsg-1vulnerable
Ubuntunode-axiospro1.13.2+dfsg-1build1vulnerable
Ubuntunode-axiospro1.13.2+dfsg-1ubuntu0.1~esm1fixed
Ubuntunode-axiospro1.11.0+dfsg-1vulnerable
Ubuntunode-axiospro1.12.1+dfsg-1vulnerable
Ubuntunode-axiospro1.13.2+dfsg-1build1vulnerable
Ubuntunode-axiospro1.13.2+dfsg-1ubuntu0.1~esm1fixed
Ubuntunode-axios25.101.7.9+dfsg-1vulnerable
Ubuntunode-axios25.101.8.4+dfsg-1vulnerable
Ubuntunode-axios25.101.11.0+dfsg-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-axiossourcesid1.15.0-1not yet assignedNot reportedNot reported
Debiannode-axiossourceforky1.15.0-1not yet assignedNot reportedNot reported
Debiannode-axiossourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiannode-axiossourcebookworm(unfixed)not yet assignedNot reportedNot reported
CpeaxioscpeNot reported0.31.0Not reportedNot reportedNot reported
CpeaxioscpeNot reported1.15.0Not reportedNot reportedNot reported
NpmaxiosnpmNot reported0.31.0Not reportedGHSA-3P68-RC4W-QGX5Not reported
NpmaxiosnpmNot reported0.31.0Not reportedNot reportedNot reported
Ubuntunode-axiosdebnoble1.6.8+dfsg-2ubuntu0.1~esm1Not reportedNot reportedNot reported
CpeaxioscpeNot reported1.15.0Not reportedNVD-CVE-2025-62718Not reported
Ubuntunode-axiosdebpro1.13.2+dfsg-1ubuntu0.1~esm1Not reportedUSN-8638-1Not reported
Ubuntunode-axiosdebpro1.13.2+dfsg-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2025-62718Not reported

Notes

[trixie] node-axios: Minor issue [bookworm] node-axios: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-axios]Affected
    Details (2)

    • 1.2.1+dfsg-1+deb12u1 · all · bookworm

      Affected

      nvd · node-axios · debian · bookworm

    • 1.2.1+dfsg-1+deb12u1 · all · bookworm

      Affected

      nvd · node-axios · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]