CVE-2026-67315
CVE-2026-67315 · axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0
This page contains facts from public vulnerability sources. Check the original advisory before updating.
axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.
CVSS 6.9 · Medium · EPSS 0.5% · Fix available
- Published
- Updated
Affected products and versions
axios
- Versions
- ≥ 1.15.0, < 1.18.0: Affected (semver)
- 1.18.0: Not affected (semver)
Update to 1.18.0
axios
- Versions
- ≥ 0.31.0, < 0.33.0: Affected (semver)
- 0.33.0: Not affected (semver)
Update to 0.33.0
node-axios Debian:14
- Versions
- 1.11.0+dfsg-1
- 1.12.1+dfsg-1
- 1.13.1+dfsg-1
- 1.13.2+dfsg-1
- 1.14.0+dfsg-1
- 1.15.0-1
- 1.15.2-1
- 1.16.0-1
- 1.8.4+dfsg-1
- Affected ranges
- ECOSYSTEM: < 1.18.0-1
Update to 1.18.0-1
axios npm
- Affected ranges
- SEMVER: ≥ 1.15.0, < 1.18.0
Update to 1.18.0
axios npm
- Affected ranges
- SEMVER: ≥ 0.31.0, < 0.33.0
Update to 0.33.0
node-axios Ubuntu:Pro:20.04:LTS
- Versions
- 0.19.0+dfsg-2
- 0.19.0+dfsg-2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-axios Ubuntu:Pro:22.04:LTS
- Versions
- 0.21.1+dfsg-1
- 0.23.0+dfsg-2
- 0.24.0+dfsg-1
- 0.25.0+dfsg-2
- 0.26.0+dfsg-1
- 0.26.0+dfsg-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-axios Ubuntu:Pro:24.04:LTS
- Versions
- 1.2.1+dfsg-1
- 1.5.1+dfsg-1
- 1.6.2+dfsg-1
- 1.6.8+dfsg-2
- 1.6.8+dfsg-2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-axios Ubuntu:Pro:26.04:LTS
- Versions
- 1.11.0+dfsg-1
- 1.12.1+dfsg-1
- 1.13.2+dfsg-1build1
- 1.13.2+dfsg-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published