Axios mistakenly treats CIDR entries in the NO_PROXY list as simple hostname suffixes, causing requests to addresses that should bypass the proxy to be sent through it. When a proxy is engaged, an attacker controlling that proxy can observe and alter HTTP traffic or capture CONNECT metadata for HTTPS requests, compromising confidentiality and integrity of internal communications. The flaw is a protection‑mechanism failure, as reflected by CWE‑693.

Axios library versions from 1.15.0 through before 1.20.0 are vulnerable. The fix was introduced in release 1.20.0; later versions are not affected.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. Nevertheless, the ability for an attacker who controls the proxy to read or modify internal traffic presents a noteworthy risk. The likely attack vector involves compromising or deceiving the proxy through which internal requests are unintentionally routed.