The vulnerability CVE-2025-62718 affects Axios versions used in Red Hat Network Observability (NETOBSERV) 1.11.1 prior to 1.11.2. Axios does not correctly handle hostname normalization when processing NO_PROXY environment variable rules, enabling attackers to craft requests to loopback addresses (e.g., localhost or [::1]) that bypass NO_PROXY exclusions and are routed through the configured proxy. This behavior can be exploited to perform Server-Side Request Forgery (SSRF), allowing attackers to access internal or loopback services that should be protected. The impact is limited by the need for the attacker to control URLs in a server-side context, the presence of both HTTP_PROXY and NO_PROXY configurations, and the proxy's position or compromise to intercept traffic. Red Hat has classified this vulnerability as high severity but currently does not have an official fix that meets their deployment and stability criteria. The advisory references multiple CWEs related to input validation and security bypasses. Users are advised to monitor Red Hat advisories for updates.

This vulnerability allows an attacker to bypass NO_PROXY settings in Axios, potentially enabling Server-Side Request Forgery (SSRF) attacks. SSRF can expose sensitive internal or loopback network services that are normally protected from external access. However, exploitation requires specific conditions: attacker control over URLs passed to Axios in a server-side environment, configured HTTP_PROXY and NO_PROXY environment variables, and a proxy capable of intercepting or rerouting traffic. The overall impact is high due to the confidentiality risk of accessing internal services, but the complexity and preconditions reduce the likelihood of exploitation.

Red Hat currently does not provide an official fix that meets their criteria for this vulnerability. Mitigation options are limited or unavailable. Users should monitor Red Hat security advisories and apply updates when a suitable fix is released. Until then, restricting control over URLs passed to Axios in server-side contexts and carefully managing proxy configurations may reduce risk. Customers with Red Hat Technical Account Managers (TAM) can consult them for tailored guidance.