Proxy Bypass and SSRF in Axios via NO_PROXY Hostname Handling

Executive Summary

CVE-2025-62718 is a critical security vulnerability in the Axios HTTP client library that arises from improper hostname normalization when evaluating NO_PROXY environment variable rules. Axios failed to correctly handle hostnames with trailing dots (e.g., "localhost.") and IPv6 literals (e.g., "[::1]") during proxy bypass checks. This flaw caused requests to loopback or internal addresses to bypass NO_PROXY rules and be routed through a proxy, contrary to developer expectations.

Because of this, attackers can exploit the vulnerability to force requests to internal or loopback services through an attacker-controlled proxy, enabling Server-Side Request Forgery (SSRF) attacks. This allows unauthorized access to sensitive internal services despite protections configured via NO_PROXY.

The vulnerability was fixed in Axios version 1.15.0 by introducing a hostname normalization helper that correctly handles trailing dots, bracketed IPv6 addresses, wildcards, and port matching to ensure NO_PROXY rules are properly enforced.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious security impacts by allowing attackers to bypass proxy restrictions intended to protect internal or loopback services. Specifically, it enables Server-Side Request Forgery (SSRF) attacks where an attacker can coerce Axios to send requests through a proxy to sensitive internal endpoints that should have been excluded by NO_PROXY rules.

The impact includes unauthorized access to internal services, potential data exfiltration, and exposure of sensitive information. Attackers controlling request URLs can exploit this to reach internal network resources that are normally protected, undermining network segmentation and security controls.

The vulnerability has a high CVSS v4 base score of 9.3, indicating critical severity with high confidentiality impact, low integrity and availability impacts, and no required privileges or user interaction.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves Axios incorrectly handling hostname normalization when evaluating NO_PROXY rules, allowing requests to loopback addresses like localhost. or [::1] to bypass proxy exclusions. To detect exploitation attempts on your network or system, you can monitor proxy logs for requests that should have been excluded by NO_PROXY but are still being proxied.

Specifically, look for requests targeting loopback addresses with trailing dots (e.g., "localhost.") or bracketed IPv6 literals (e.g., "[::1]") that are unexpectedly routed through the proxy.

Suggested commands or methods include:

• Check proxy server access logs for requests to loopback addresses with trailing dots or IPv6 literals.
• Use network packet capture tools (e.g., tcpdump, Wireshark) to filter HTTP requests containing hostnames like "localhost." or "[::1]" that are sent through proxies.
• On systems running Axios, audit the Axios version in use (e.g., via npm list axios) to identify vulnerable versions prior to 1.15.0.
• Review application logs or debug output for HTTP requests that unexpectedly use proxies despite NO_PROXY settings.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Axios to version 1.15.0 or later, where this vulnerability is fixed by properly normalizing hostnames and correctly applying NO_PROXY rules.

Additional immediate steps include:

• Audit your environment variables NO_PROXY and no_proxy to ensure they explicitly include loopback addresses such as localhost, localhost., and [::1].
• Temporarily disable proxy usage for internal or loopback addresses at the network or proxy configuration level if possible.
• Monitor and restrict outbound proxy traffic to prevent unauthorized requests to internal services.
• Apply network-level controls or firewall rules to block unexpected proxy traffic targeting loopback or internal IP addresses.

These steps help reduce the risk of SSRF and proxy bypass attacks until the Axios library is updated.

Useful 0 Not Useful 0

Compliance Impact

The CVE-2025-62718 vulnerability in Axios allows attackers to bypass NO_PROXY rules and force requests to internal or loopback services through a proxy. This can lead to Server-Side Request Forgery (SSRF) attacks, potentially exposing sensitive internal services and data.

Such unauthorized access and data exposure risks can negatively impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls over access to sensitive personal and health information. The vulnerability undermines network security controls designed to prevent unauthorized data access or exfiltration, thereby increasing the risk of data breaches.

By allowing attackers to circumvent proxy restrictions and access internal services, this vulnerability could lead to confidentiality breaches and unauthorized data disclosure, which are critical compliance concerns under these regulations.

Useful 0 Not Useful 0