The vulnerability in axios versions 1.15.0 before 1.18.0 arises from a failure to identify 0.0.0.0 as a loopback address within the shouldBypassProxy.js logic. As a result, requests targeting 0.0.0.0 do not bypass proxy settings as intended by NO_PROXY environment variables. Attackers can exploit this by supplying URLs with 0.0.0.0, causing requests to be routed through proxies that may have network access to internal or local services, potentially exposing those services unintentionally.

Requests to 0.0.0.0 can bypass NO_PROXY rules and be routed through proxies, which may expose local or internal services accessible by the proxy. This could lead to unintended information disclosure or access to internal resources if the proxy is trusted and can reach those destinations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should avoid using axios versions 1.15.0 through 1.17.x with untrusted proxy configurations or consider implementing additional proxy bypass checks externally to mitigate this issue.