CVE-2026-67315 is a high severity flaw in axios where requests to 0.0.0.0 are not treated as local, so they can skip NO_PROXY rules in Node.js. The record scores it 7.5 and the advisory 6.9. Axios 1.18.0 and 0.33.0 fix it. Upgrade, and validate request URLs that users can influence.
What's affected
axios from 0.31.0 before 0.33.0, and from 1.15.0 before 1.18.0. The patched versions are 0.33.0 and 1.18.0.
Severity differs. The record gives CVSS 7.5 (High). The axios advisory rates it Moderate, 6.9. The weakness is CWE-183, a permissive list of allowed inputs.
The advisory says the helper that checks NO_PROXY recognizes localhost, the 127.0.0.0/8 range, the IPv6 loopback and some mapped forms, but not 0.0.0.0. In a Node.js app that uses HTTP_PROXY or HTTPS_PROXY together with a NO_PROXY list such as localhost and 127.0.0.1, a request to 0.0.0.0 can go through the proxy.
The advisory lists the conditions. Axios runs in Node.js with the HTTP adapter. The process uses proxy environment variables. NO_PROXY keeps local traffic away from the proxy. Attacker controlled input can influence the request URL or a redirect target. And the proxy does not reject 0.0.0.0 and can reach the local destination. Browser, React Native, XHR and fetch adapters are not affected.
How to check if you're exposed
Find every copy of axios, direct and transitive:
npm ls axios
npm why axios
Yarn and pnpm users can run yarn why axios or pnpm why axios. Look at the lockfile too, since a transitive dependency can pin an older copy than your top level package.json suggests.
Then check the environment of your Node.js services for proxy variables:
env | grep -i proxy
If a service has no proxy variables, or never fetches URLs that users supply, the path is closed. If it does both, review which URLs reach axios.
What to do now
- Upgrade axios to 1.18.0, or 0.33.0 on the 0.x line.
- Add 0.0.0.0 to your NO_PROXY list as a stop gap, if your tooling allows it.
- Validate and restrict URLs that users can submit, including redirect targets.
- Configure your proxy to refuse requests to local and unspecified addresses.
- Paste your dependency file into the free in-browser scan at gold.safeguard.sh/scan to see which of your projects pull in an affected version.
Why it matters
This is a server side request forgery relative. The service is tricked into talking to a local address, but here the twist is that the proxy, which is meant to be bypassed for local traffic, ends up in the path. For plain HTTP targets the advisory says the proxy can see the full URL, headers and body, and may see the local service's response. HTTPS targets are less exposed, because axios uses a CONNECT tunnel.
The address 0.0.0.0 is often treated by operating systems as meaning this host, which is why it belongs on any list of local addresses. The fix is a one line fact added to the helper.
No source I reviewed says this CVE is exploited in the wild, and the record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect browsers?
No. The advisory says browser, React Native, XHR and fetch adapters are not affected.
Is a stop gap available?
Adding 0.0.0.0 to NO_PROXY may help, but upgrading is the fix.
Sources
Last reviewed: 18 October 2026.
