CVE-2025-62718

Published Apr 9, 2026

Last updated 20 hours ago

CVSS critical 9.3
Axios
Node.js

Overview

Description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0.
Source
security-advisories@github.com
NVD status
Awaiting Analysis

Risk scores

CVSS 4.0

Type
Secondary
Base score
9.3
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
CRITICAL

Weaknesses

security-advisories@github.com
CWE-441

Social media

Hype score
Not currently trending

  1. A NO_PROXY hostname normalization bypass (CVE-2025-62718) in `Axios` could lead to SSRF. Implement strict input validation and monitor for patches. #Axios #SSRF #infosec https://t.co/WXaOC4cAHG

    @pulsepatchio

    11 Apr 2026

    244 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🚨 Critical Axios flaw: CVE-2025-62718 A NO_PROXY hostname normalization bypass could expose internal services and weaken proxy-based protections. Update to the patched version now. 🔗 https://t.co/9DxECL7lYV #CyberSecurity #Axios #CVE202562718 #Vulert https://t.co/TCbiiUdB2V

    @vulert_official

    10 Apr 2026

    222 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. csirt_it: ‼ #Axios: disponibile #PoC per lo sfruttamento della CVE-2025-62718, presente nella nota libreria open source Rischio: 🔴 Tipologia: 🔸 Information Disclosure 🔸 Spoofing 🔗 https://t.co/2svV2NWHHY ⚠ Importante mantenere aggiornati i sist… https://t.co

    @Vulcanux_

    10 Apr 2026

    175 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. ‼ #Axios: disponibile #PoC per lo sfruttamento della CVE-2025-62718, presente nella nota libreria open source Rischio: 🔴 Tipologia: 🔸 Information Disclosure 🔸 Spoofing 🔗 https://t.co/QtFHPBplYq ⚠ Importante mantenere aggiornati i sistemi https://t.co/6gBaSyUaD

    @csirt_it

    10 Apr 2026

    362 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  5. 🚨 New CRITICAL CVE detected in AWS Lambda 🚨 CVE-2025-62718 impacts axios in 4 Lambda base images. Details: https://t.co/9dlFffg6Zv More: https://t.co/6EUGaPyRZk #AWS #Lambda #CVE #CloudSecurity #Serverless

    @LambdaWatchdog

    10 Apr 2026

    147 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. CVE-2025-62718 Proxy Bypass and SSRF via Hostname Normalization in Axios Before 1.15.0 https://t.co/JhQG7A0nY0

    @VulmonFeeds

    9 Apr 2026

    186 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  7. CVE-2025-62718 Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules… https://t.co/NPkSPMTV1M

    @CVEnew

    9 Apr 2026

    271 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. 🚨 CVE-2025-62718: Axios has a NO_PROXY Hostname No... Hostname normalization bypass in Axios lets attackers proxy-hop past NO_PROXY protections with trailing dots and IPv6 l... https://t.co/K0GpVbS68F #netsec #vulnerability #CVE #sysadmin #zeroday

    @0dayPublishing

    9 Apr 2026

    207 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.•CVE-2025-59466
  2. Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses the user-provided mcpServerConfig string to build the MCP server configuration. However, during this process, it executes JavaScript code without any security validation. Specifically, inside the convertToValidJSONString function, user input is directly passed to the Function() constructor, which evaluates and executes the input as JavaScript code. Since this runs with full Node.js runtime privileges, it can access dangerous modules such as child_process and fs. This issue has been patched in version 3.0.6.•CVE-2025-59528
  3. Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox. This is fixed in version 0.2.1.•CVE-2025-54782
  4. An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of `path.join` API.•CVE-2025-27210
  5. axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.•CVE-2025-27152

References

Sources include official advisories and independent security research.