Axios erroneously interprets CIDR entries in the NO_PROXY list as simple hostname suffixes, causing requests to addresses that should be exempt from proxy routing to be sent through the proxy. This flaw allows an attacker who controls or deceives the proxy to observe, modify, or tamper with HTTP requests and reveal connection metadata for HTTPS requests, thereby compromising confidentiality and integrity of internal communications.

Axios library versions from 1.15.0 up to, but excluding, 1.20.0 are vulnerable. The problem is resolved in release 1.20.0, and later releases are not affected.

The CVSS score of 6.9 signals moderate severity. The EPSS score of < 1% and absence from KEV suggest that exploitation is currently unlikely, but the vulnerability remains noteworthy because an attacker who gains control over the configured proxy can read or alter internal traffic. The likely attack vector is a compromised or malicious proxy that intercepts traffic destined for internally routed addresses.