Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching — it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.
| Vendor | Product | Versions |
|---|---|---|
| axios | axios | npm/axios: >= 1.0.0, < 1.15.1, npm/axios: <= 0.31.0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| ibm | app connect enterprise | cert_advisory | 90% |
| npm | axios | GHSA | 85% |
Updated severity to CRITICAL and marked the vulnerability as actively exploited.
Initial creation
