Threats tagged 'ghsa-pmwg-cvhr-8vh7'

Axios versions prior to 1.15.1 and 0.31.1 contain an incomplete fix for CVE-2025-62718, where the NO_PROXY environment variable protection can be bypassed via loopback addresses in the 127.0.0.0/8 subnet. The vulnerability arises because Axios only recognizes 127.0.0.1 as a loopback address, ignoring the full RFC 1122-defined 127.0.0.0/8 range. This allows an attacker controlling the target URL to bypass proxy exclusion rules by using other 127.x.x.x addresses, causing requests to be forwarded to a proxy despite NO_PROXY settings. The issue was patched in Axios 1.15.1 and 0.31.1.