Axios can incorrectly skip NO_PROXY checks when a hostname appears in a trailing‑dot form such as "localhost." or uses the IPv6 literal "[::1]". This oversight indicates a hostname normalization weakness (CWE‑1289) and a misinterpretation of proxy configuration (CWE‑441), allowing requests to be sent through a configured proxy even when NO_PROXY is intended to protect internal or loopback addresses. The result is that an attacker can force Axios to send internal or otherwise protected traffic to any target, creating a vulnerability that could be used for SSRF (CWE‑918), data exfiltration, or denial of service against hidden services. The impact therefore spans confidentiality, integrity, and availability of resources that were assumed to be safe from external reach. Based on the description, it is inferred that the attack vector requires an attacker to induce the application to issue HTTP requests via Axios that trigger the NO_PROXY bypass, allowing external traffic to reach internal endpoints through a proxy.

Axios, the promise‑based HTTP client for browsers and Node.js, is affected when it is older than version 1.15.0 or 0.31.0. Any application that imports or requires Axios from these older releases, whether running in a browser environment or a Node.js runtime, is vulnerable. The flaw exists in both the browser and Node.js builds and applies to any configuration that relies on the NO_PROXY environment variable or its equivalent.

The vulnerability carries a CVSS score of 6.3, classifying it as medium. The EPSS score of <1% indicates a low exploitation probability, suggesting that while the flaw could be used for SSRF, it is currently unlikely to be exploited widely. The attack requires the ability to influence the Axios request or configuration; once that is possible, the attacker can force traffic through a proxy to internal endpoints, potentially executing SSRF against protected services.