An attacker who can influence the target URL in an Axios request can specify any address within 127.0.0.0/8 except 127.0.0.1 to fully bypass the NO_PROXY setting. This allows a request that would normally be routed through a configured proxy to instead reach an internal or loopback address, potentially exposing internal services or data. The flaw is rooted in an incomplete fix for a prior issue and is classified as a high‑severity bypass.*

The vulnerability affects all Axios clients on the 1.15.0 release line and earlier, as well as the 0.31.0 release line and earlier. Any application running Node.js that includes those versions of Axios and sends HTTP requests with user‑controlled URLs is susceptible. Updating to 1.15.1 or 0.31.1 (or later) removes the flaw.

The CVSS score of 7.2 indicates high severity, while the EPSS score of less than 1% suggests a very low probability of exploitation as of this assessment. The vulnerability is not listed in CISA’s KEV catalog. If an application or service can inject URLs into Axios, an attacker could redirect connections to internal addresses, bypassing proxy restrictions and potentially exposing sensitive resources. Because the attack requires control of the request URL, environments that expose this ability to untrusted input pose the greatest risk.*