CVE-2025-62718: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

Vulnerability summary

CVE-2025-62718 is a critical (CVSS 9.9) Unintended Proxy or Intermediary vulnerability in axios. EPSS estimates a 1.19% chance of exploitation in the next 30 days, higher than 67.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 09-04-2026
   PublishedVulnerability first disclosed.
2. 10-09-2026
   Last modifiedVulnerability information updated.

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0 and 0.31.0.

• CWE-441Unintended Proxy or IntermediaryThe product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere.
• CWE-918Server-Side Request ForgeryThe web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
• CWE-1289Improper Validation of Unsafe Equivalence in InputThe product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.