The vulnerability CVE-2025-62718 affects Axios, a widely used HTTP client, due to improper handling of hostname normalization in NO_PROXY rule evaluation. This allows attackers to craft requests targeting loopback addresses (e.g., localhost or [::1]) that bypass NO_PROXY configurations and are routed through the configured proxy. This behavior can be exploited to perform Server-Side Request Forgery (SSRF), enabling access to internal or loopback services that should be protected. The impact is limited by the requirement that the attacker must control or influence URLs passed to Axios in a server-side context, the presence of both HTTP_PROXY and NO_PROXY environment variables, and the proxy's ability to intercept or act on the rerouted traffic. Red Hat's advisory indicates no current fix meets their criteria for deployment, and mitigation options are limited.

Successful exploitation of this vulnerability can lead to SSRF attacks, potentially exposing sensitive internal or loopback services that are normally inaccessible. However, the impact is constrained by several non-default conditions, including the need for attacker control over URLs processed by Axios, specific proxy environment configurations, and proxy behavior. There are no known exploits in the wild at this time.

Red Hat currently does not provide an official fix or mitigation that meets their criteria for ease of use, applicability, and stability. Users should monitor Red Hat advisories for future updates. Given the limited exploit conditions, review application usage of Axios and proxy configurations to minimize exposure. Consider restricting or validating URLs passed to Axios in server-side contexts to reduce risk.