CVE-2025-62718

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

No known exploitation. EPSS puts it in the 68th percentile. A vendor fix is available.

CVSS 3.19.9Critical EPSS percentile68th1.2% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-04-09Updated 2026-10-14Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

AxiosAffected: >= 1.0.0, < 1.15.0Upgrade to: not statedAffected: < 0.31.0Upgrade to: not statedStated by: CVE record
NPM, Inc. axiosAffected: до 1.15.0Upgrade to: not statedStated by: BDU

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which Axios version your application uses (in your Node.js project dependencies) and whether it is older than 1.15.0 or 0.31.0.
If you use an affected Axios version, upgrade Axios to 1.15.0 or 0.31.0 (depending on your codebase/branch).
Verify your NO_PROXY and proxy settings still behave as expected after the upgrade (especially blocking localhost and [::1]).
If you cannot upgrade immediately, reduce risk by temporarily disabling the proxy path for requests from untrusted input and restrict which destinations your server can call.

npm install axios@^1.15.0

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0 and 0.31.0.

In plain language

Written by AI from the record

CVE-2025-62718 is a bug in Axios that lets an attacker bypass your NO_PROXY protections and use your proxy to reach internal services (SSRF) if you’re using an older Axios version.

Unauthenticated SSRF via a NO_PROXY hostname normalization bypass in Axios; by supplying a specially formatted hostname (e.g., a loopback hostname with a trailing dot like “localhost.”), attackers can cause Axios to skip NO_PROXY matching and send the request through the configured proxy (affected if you use Axios versions prior to 1.15.0 or 0.31.0).

If you're affected

Access to internal network services
Exposure of sensitive internal data
Pivoting through the proxy
Potential system disruption

What is it

Axios is a common “web request” library used by many apps to fetch data over HTTP. This bug means that even if you tried to block access to local/internal addresses using NO_PROXY, a carefully crafted hostname can slip past that check and send traffic through your proxy instead. In plain terms: it could let a bad request reach hidden internal services your app should never be able to contact.

Who is affected

This matters if your business runs a Node.js app (or service) that uses the Axios library and accepts any user-controlled input that can influence what URL/host you request (for example, letting customers supply a URL to fetch). It also matters if your environment uses a proxy together with NO_PROXY rules intended to block localhost or internal addresses. The risk is mainly present when your Axios version is older than 1.15.0 or 0.31.0 and the attacker can reach the part of your application that triggers outbound requests—there is no login required for the Axios-level bug itself.

How urgent is it

This is a high-impact server-side request forgery issue because attackers can bypass your NO_PROXY protections and push requests through your proxy to internal targets. While a public exploit isn’t listed and there’s no CISA KEV entry, the flaw is severe enough (SSRF) that you should treat upgrading as urgent for any affected app. Aim to fix it quickly rather than waiting for “later,” especially if your app makes outbound requests based on user input.

What to do — in detail

Confirm you’re using the affected Axios versions
- In your project, check the installed Axios version (e.g., from your dependency manifest/lockfile).
- This issue applies if you use Axios prior to 1.15.0 or 0.31.0.
Confirm whether the vulnerable behavior can be triggered
- Identify the code path where your app calls Axios.
- Look for cases where the destination URL/host is influenced by external/untrusted data (even indirectly).
- Check whether you use a proxy and a NO_PROXY environment variable intended to block loopback or internal addresses (like localhost or [::1]).
Upgrade to the fixed Axios versions
- Upgrade Axios to 1.15.0 or 0.31.0 as applicable to your environment/branch.
- After upgrading, run your normal test suite and any integration tests that exercise outbound HTTP calls.
Validate behavior post-upgrade
- Re-check that NO_PROXY correctly blocks loopback/internal destinations (especially localhost and [::1]) and that requests no longer get routed through the proxy when they should be blocked.
If you cannot upgrade immediately (workaround guidance)
- Ensure untrusted inputs cannot control the full request destination.
- Consider restricting outbound requests to an allowlist of approved domains/hosts.
- Where possible, disable or constrain the proxy usage for requests originating from untrusted input until the upgrade is completed.
What to monitor
- Monitor outbound HTTP requests from the service for unexpected internal addresses or proxy usage patterns.
- Review logs around requests that include unusual hostnames (e.g., variations that could bypass matching) or unexpected internal targets.

Technical context

Severity/impact: The reported risk includes Server Side Request Forgery (SSRF) with access to internal resources, with a very high CVSS score shown for this issue. Mechanism: Axios prior to 1.15.0/0.31.0 performs incorrect hostname normalization when applying NO_PROXY rules, allowing bypass using specially formatted loopback hostnames such as “localhost.” (trailing dot) or IPv6 literal forms (e.g., [::1]) so the request is proxied instead of blocked. Attack vector: network-triggered; authentication and user interaction are not required at the Axios vulnerability level. Exploitation status: no public exploit code is on record and CVE-2025-62718 is not listed in CISA KEV. Predicted likelihood: EPSS is provided as a prediction only and is not relied upon for action because SSRF is high impact; KEV/news (if they appeared) would override predictions. What KEV means here: it indicates confirmed widespread exploitation; it is currently not listed, so exploitation is not confirmed via KEV. Fix: The issue is fixed in Axios 1.15.0 and 0.31.0 (per provided commits/advisories). Exploit maturity: unknown beyond the absence of public exploit code; treat as a serious SSRF primitive in affected deployments.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS68th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.2% chance of exploitation activity in the next 30 days, which ranks it in the 68th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained.

Lifecycle

70 events over 188 days, from the signal feeds we watch.

2026-10-14Patch availableworkaround available, record updated
2026-09-10Patch availableworkaround available, record updated
2026-09-07Patch availableworkaround available, record updated
2026-09-04Patch availableworkaround available, record updated
2026-08-31Patch availableworkaround available, record updated
2026-08-25Patch availableworkaround available, record updated

Affected products

NPM, Inc.commercial
- axiosOSS Libraries
axiospackage-ecosystem
- axiosLibraryOSS Libraries / npm

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Scored 9.9 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity LowData modification is possible but limited in scope or consequence
Availability LowReduced performance or intermittent disruption of service