CVE-2026-67315

axios fails to recognize 0.0.0.0 as a loopback address in its shouldBypassProxy.js logic, so requests targeting 0.0.0.0 are not matched by NO_PROXY rules and are instead routed through the configured proxy. An attacker who can influence destination URLs can cause requests intended for a loopback/local destination to be sent through the proxy, potentially exposing local services when the proxy can reach the destination. The CVSS 4.0 scoring indicates low confidentiality impact on the vulnerable system but high confidentiality impact on subsequent systems. Any application using the affected axios versions together with a proxy and NO_PROXY configuration is affected. There is no known in-the-wild exploitation; a public advisory/PoC exists and EPSS puts 30-day exploitation probability at 0.3%.

What to do: Upgrade axios to 0.33.0 (0.x line) or 1.18.0 or later (1.x line). As interim mitigation, do not rely on NO_PROXY to exclude 0.0.0.0: validate or normalize destination URLs to treat 0.0.0.0 as loopback, and ensure the configured proxy cannot forward requests to internal/local services. Audit applications' proxy and NO_PROXY configurations to determine whether they are actually exposed.