Axios, a popular HTTP client for browsers and Node.js, contains a flaw in its NO_PROXY processing that allows loopback addresses such as localhost. (with a trailing dot) or the IPv6 literal [::1] to bypass the intended proxy exclusion list. Because hostname normalization is performed incorrectly, these requests are forwarded to the configured proxy. The result is that an attacker can force traffic to sensitive local or internal services that should not be reachable through the proxy, thereby creating a Server‑Side Request Forgery (SSRF) vulnerability.

Applications that incorporate any Axios version prior to 1.15.0 and that rely on NO_PROXY to protect loopback or internal services are affected. This includes both browser‑side and server‑side code that configures a proxy for HTTP requests.

The CVSS score of 9.3 reflects a high severity and indicates that exploitation is likely to succeed in compromising confidentiality and availability of internal resources. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is a request that reaches the application’s Axios instance, allowing an attacker to direct traffic through the proxy to internal loopback addresses and thereby achieve SSRF. The risk is compounded in environments where attackers can influence the request URL, such as compromised user input or malicious code execution within the application.