Vulnerability Details CVE-2026-67315
axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 21.3%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2026-67315
-
cpe:2.3:a:axios:axios:0.31.0
-
cpe:2.3:a:axios:axios:0.31.1
-
cpe:2.3:a:axios:axios:0.32.0
-
cpe:2.3:a:axios:axios:1.15.0
-
cpe:2.3:a:axios:axios:1.15.1
-
cpe:2.3:a:axios:axios:1.15.2
-
cpe:2.3:a:axios:axios:1.16.0