CVE-2026-67315: axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0
axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NOPROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
axiosto a version that resolves this vulnerability.Fixed in 0.33.0 - Upgrade
Upgrade
axiosto a version that resolves this vulnerability.Fixed in 1.18.0 - Configuration
Update axios so that requests to 0.0.0.0 are recognized as loopback and do not bypass NO_PROXY rules (fixes the NO_PROXY bypass described in shouldBypassProxy.js).
axios (proxy handling / NO_PROXY) NO_PROXY bypass for 0.0.0.0 URLs = Ensure 0.0.0.0 is treated as loopback and shouldBypassProxy.js fails to bypass NO_PROXY
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67315?
The severity of CVE-2026-67315 is rated at 40.
How do I fix CVE-2026-67315?
To fix CVE-2026-67315, upgrade axios to version 1.18.0 or later.
What does CVE-2026-67315 affect?
CVE-2026-67315 affects axios versions 1.15.0 before 1.18.0.
What vulnerability does CVE-2026-67315 expose?
CVE-2026-67315 exposes local services by allowing requests to bypass NO_PROXY rules.
How can attackers exploit CVE-2026-67315?
Attackers can exploit CVE-2026-67315 by supplying 0.0.0.0 URLs to route requests through configured proxies.