CVE WatchJul 15, 2026

CVE-2025-62718

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname norma

CVSS

9.9

Critical

EPSS

1.2%

p64

KEV

—

Exploit Today

0-100

Published: Apr 9, 2026 · Last modified: Jul 15, 2026 · CWE-441 · CWE-918 · CWE-1289

EPSS · 30d

1.2%EPSS · 30 days1.2%

2026-06-302026-07-16

Technical description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0 and 0.31.0.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-202308.6 HIG

98.5%

KEV—80Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability15d CVE-2026-1540910.0 CRI

66.4%

KEV—70SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability21h CVE-2020-248819.8 CRI

99.4%

——30SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.6d CVE-2026-445788.6 HIG

98.4%

——30Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.14h CVE-2023-271597.5 HIG

98.3%

——29Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.8d CVE-2026-483327.7 HIG

95.7%

——29ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.1d