Technical impact
The issue arises when axios’ proxy‑bypass logic fails to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to that address to bypass NO_PROXY rules. An attacker who can provide a URL to axios can thus force the library to send traffic through a configured proxy that routes to 0.0.0.0, effectively exposing local services that should remain internal. This weakness is associated with improper handling of IPv4 addresses (CWE‑115) and misclassification of 0.0.0.0 as a loopback address (CWE‑183), which may lead to unauthorized data exposure or other compromise if the proxied endpoint trusts the connection. While the flaw does not provide immediate code execution, it can be exploited to circumvent network isolation policies and serve as a foothold to internal resources.
Affected Systems
Axios, the Node.js HTTP client library, is affected in releases from 0.31.0 up to, but not including, 0.33.0 and from 1.15.0 up to, but not including, 1.18.0. The flaw was corrected in 0.33.0 and 1.18.0, which correctly flag 0.0.0.0 as a loopback address.
Risk and Exploitability
The CVSS score of 6.9 indicates a medium impact on confidentiality, integrity, and availability. Exploitation requires the attacker to supply a URL that axios will resolve, so the threat is typically tied to environments where user input or compromised code can control the request path. The EPSS score is 0.00291, and the vulnerability is not listed in the CISA KEV catalog, meaning no mass exploitation is currently known. Nonetheless, delivering traffic to localhost through an egress proxy can enable data leakage or additional compromise if the proxy or target service is malicious. The overall risk is moderate but should be addressed promptly, especially for applications that allow untrusted input.
Github GHSA