Threats tagged 'ghsa-m7pr-hjqh-92cm'

Axios versions prior to 1.15.1 and 0.31.1 contain a vulnerability in the no_proxy environment variable handling that allows bypassing proxy restrictions via IP aliasing. Specifically, when no_proxy=localhost is set, requests to 127.0.0.1 and [::1] do not bypass the proxy as intended, due to the shouldBypassProxy() function performing only string matching without resolving loopback IP aliases. This can lead to server-side request forgery (SSRF) risks where an attacker can route internal requests through a malicious proxy.