Permissive List of Allowed Inputs Affecting axios package, versions >=0.31.0 <0.33.0>=1.15.0 <1.18.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-AXIOS-18065357
- published21 Jul 2026
- disclosed20 Jul 2026
- creditjayant-eai
Introduced: 20 Jul 2026
New CVE NOT AVAILABLE CWE-183 (opens in a new tab)How to fix?
Upgrade axios to version 0.33.0, 1.18.0 or higher.
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Permissive List of Allowed Inputs in the isLoopback() and isIPv4Loopback() functions of lib/helpers/shouldBypassProxy.js, which require the first IPv4 octet to be 127 and therefore do not recognize 0.0.0.0 as a loopback address. An attacker who controls the request URL or a redirect target can bypass the NO_PROXY policy for local addresses and route requests to http://0.0.0.0:<port>/ through the configured proxy, reaching internal services, cloud IMDS endpoints, or microservice APIs. Exploitation requires the Node HTTP adapter with HTTP_PROXY or HTTPS_PROXY set and NO_PROXY listing local addresses, attacker control over the URL or redirect target, and a proxy able to reach the local destinations.
Workaround
This vulnerability can be avoided by explicitly adding 0.0.0.0 to the NO_PROXY list, so requests to it are excluded from the proxy as the loopback check intended.