CVE-2025-62718 is a security flaw in Axios where hostname normalization is improperly handled when evaluating NO_PROXY rules. This allows attackers to craft requests to loopback addresses (e.g., localhost or [::1]) that bypass NO_PROXY and are routed through the configured proxy, enabling SSRF attacks. The vulnerability requires that the application uses Axios server-side with both HTTP_PROXY and NO_PROXY configured, and that the proxy is positioned to intercept or be compromised to misuse the rerouted traffic. Red Hat has identified this vulnerability affecting multiple products including Red Hat Developer Hub and multicluster engine for Kubernetes. The advisory notes no current patch or mitigation meeting Red Hat's standards is available. The CVSS score is not provided by Red Hat, but the severity is rated critical based on impact.

Successful exploitation can lead to Server-Side Request Forgery (SSRF), allowing attackers to access sensitive internal or loopback services that should be protected by NO_PROXY rules. However, exploitation is limited by the need for specific conditions: attacker-controlled URLs passed to Axios in a server-side context, presence of both HTTP_PROXY and NO_PROXY environment variables, and a proxy capable of intercepting or being compromised to misuse the traffic. This vulnerability could expose internal network resources and services to attackers.

Currently, there is no official fix or mitigation that meets Red Hat's criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for updates. Given the complexity and limited exploit conditions, review application usage of Axios with proxy configurations and consider restricting attacker control over URLs passed to Axios. Engage with Red Hat support or Technical Account Managers for guidance. Avoid relying solely on NO_PROXY configurations for security until a fix is available.