Description
axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
axios axios
Default version status: unaffected
1.15.0 to < 1.18.0affected1.18.0unaffected
pkg:npm/axiosaxios axios
Default version status: unaffected
0.31.0 to < 0.33.0affected0.33.0unaffected
pkg:npm/axios