CVE-2026-67315

HighCVSS 7.5/10Last modified Sep 1, 2026

Description

axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-183

Affected software

Vendor	Product	Versions
axios	axios	>= 1.15.0, < 1.18.0
axios	axios	>= 0.31.0, < 0.33.0

References

https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548Exploit, Mitigation, Vendor Advisory
https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-viaThird Party Advisory

Timeline

Published: Aug 1, 2026
Last modified: Sep 1, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-673167.4axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been poll CVE-2026-673177.5axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-CVE-2026-673185.3axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests a CVE-2026-673193.7axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process'CVE-2026-67327.5A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated CVE-2026-673207.5axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request c CVE-2026-673217.5axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing obje CVE-2026-673227.5GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed th CVE-2026-673238.4GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allo CVE-2026-673249.8GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its CVE-2026-673258.8GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation f CVE-2026-673267.8GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbit