CVE-2026-67315

axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.

CVSS

No CVSS.

References

Link	Resource
https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548
https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via

Configurations

No configuration.

History

02 Aug 2026, 12:16

Type	Values Removed	Values Added
Summary	(en) axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.	(en) axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.

01 Aug 2026, 13:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-08-01 13:17

Updated : 2026-08-03 17:16

NVD link : CVE-2026-67315

Mitre link : CVE-2026-67315

CVE.ORG link : CVE-2026-67315

JSON object : View

Products Affected

No product.

CWE

CWE-183

Permissive List of Allowed Inputs

{"id": "CVE-2026-67315", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67315", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-03T14:46:47.715000Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "axios", "product": "axios", "versions": [{"status": "affected", "version": "1.15.0", "lessThan": "1.18.0", "versionType": "semver"}, {"status": "unaffected", "version": "1.18.0", "versionType": "semver"}], "packageURL": "pkg:npm/axios", "defaultStatus": "unaffected"}, {"vendor": "axios", "product": "axios", "versions": [{"status": "affected", "version": "0.31.0", "lessThan": "0.33.0", "versionType": "semver"}, {"status": "unaffected", "version": "0.33.0", "versionType": "semver"}], "packageURL": "pkg:npm/axios", "defaultStatus": "unaffected"}]}], "published": "2026-08-01T13:17:01.540", "references": [{"url": "https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-183"}]}], "descriptions": [{"lang": "en", "value": "axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination."}], "lastModified": "2026-08-03T17:16:41.083", "sourceIdentifier": "disclosure@vulncheck.com"}