CVE-2025-62718 is a critical flaw in axios, the JavaScript HTTP client, scored CVSS 9.9. Hostname normalization is wrong when NO_PROXY rules are checked, so some loopback requests still go through a proxy. Upgrade to axios 1.15.0 or 0.31.0 or later.
What's affected
The NVD record says axios versions prior to 1.15.0 and prior to 0.31.0 are affected. Fixed versions are 1.15.0 on the 1.x line and 0.31.0 on the 0.x line. The weaknesses tagged are CWE-1289 (improper validation of unsafe equivalence in input), CWE-441 (unintended proxy or intermediary) and CWE-918 (server-side request forgery).
The project fixed this in pull request 10661, merged into the v1.x branch on 6 April 2026. The change adds a helper named shouldBypassProxy that is called from the Node HTTP adapter before a proxy from the environment is applied.
The flaw only matters in Node.js, where axios reads proxy settings from the environment, and only if you set a proxy and rely on NO_PROXY to keep some destinations off it. Browser builds do not read those variables.
How to check if you're exposed
Find every copy of axios in your projects, including ones pulled in by other packages.
npm ls axios
npm explain axios
pnpm why axios
yarn why axios
Compare each version with 1.15.0 for the 1.x line and 0.31.0 for the 0.x line. Remember that lock files can hold several copies, so check the resolved versions, not only the version in package.json.
Then ask whether you are in the risky setup. Do your services run in Node.js with an HTTP proxy configured, for example through HTTP_PROXY or HTTPS_PROXY in the environment, and do you use NO_PROXY to keep localhost or internal hosts off that proxy? If not, exposure is much lower, though upgrading is still sensible.
You can also run the free in-browser dependency scan to list axios copies and known issues in a manifest, without sending your code anywhere.
What to do now
- Run the commands above across every repository and container image that ships Node.js code.
- Upgrade axios to 1.15.0 or later, or to 0.31.0 or later if you must stay on the 0.x line.
- If a transitive dependency pins an old axios, update that parent package, or use your package manager's override feature as a stop gap.
- Rebuild and redeploy images so the new version actually reaches production.
- Do not rely on NO_PROXY as your only guard for loopback and internal services. Add network rules so that a proxy or a server side request cannot reach metadata and admin endpoints.
- Require authentication on internal services, so a stray request that does arrive is not trusted by default.
Why it matters
This is a server side request forgery risk, CWE-918: an attacker influences where a server sends requests, and the server uses its own network position to reach things the attacker cannot. The bug here is a mismatch between how a hostname is written and how the rule is matched. A name such as localhost with a trailing dot, or an IPv6 loopback in square brackets, means the same place but did not match the NO_PROXY entry, so the request went through the proxy instead of staying local.
The advisory's concern is the proxy bypass and what follows, which is a request reaching internal services the developer thought were protected. Developers usually write NO_PROXY to say that local destinations should never leave the machine. When the check fails, that promise is quietly broken. Related weaknesses are CWE-1289, which is about treating different spellings as equal, and CWE-441, where a proxy acts for the wrong party.
The fix normalizes trailing dots and bracketed IPv6, supports wildcards and leading dot domains, and respects explicit and default ports. The KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect axios in the browser?
The flaw is in the Node.js HTTP adapter, which reads proxy settings from the environment. Browsers handle proxies themselves, so the described issue concerns Node.js.
Which version should I choose?
Use 1.15.0 or later on the 1.x line. Use 0.31.0 or later only if you are held on the 0.x line.
Sources
Last reviewed: 19 October 2026.
