Axios versions prior to 1.15.0 and 0.31.0 do not properly normalize hostnames when evaluating NO_PROXY rules. This allows requests to loopback addresses with trailing dots or IPv6 literals to bypass NO_PROXY protections and be sent through a configured proxy. This behavior can lead to SSRF vulnerabilities by forcing internal or loopback traffic through an attacker-controlled proxy, potentially exposing sensitive internal services.