6.3
Medium
CVE-2025-62718 Axios is a promise based HTTP client for the browser and Node.js
Description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0 and 0.31.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| axios 1.0 | 1.0.0 → < 1.15.0 | 1.15.0 |
| axios 0.31 | earliest → < 0.31.0 | 0.31.0 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Versions not published | |
| Cluster Observability Operator 1.5.0 1781116667 | earliest → < 1781116667 | 1781116667 |
| Network Observability (NETOBSERV) 1.11.2 1778510461 | earliest → < 1778510461 | 1778510461 |
| Red Hat Advanced Cluster Security for Kubernetes 4.10 1779293013 | earliest → < 1779293013 | 1779293013 |
| Red Hat Advanced Cluster Security for Kubernetes 4.9 1779371594 | earliest → < 1779371594 | 1779371594 |
| Red Hat Ansible Automation Platform 2.5 1780082949 | earliest → < 1780082949 | 1780082949 |
Show the 63 other branches Hide the 63 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Ansible Automation Platform 2.6 1787184682 | earliest → < 1787184682 | 1787184682 |
| Red Hat Developer Hub 1.8 1776784286 | earliest → < 1776784286 | 1776784286 |
| Red Hat Developer Hub 1.9 1777903262 | earliest → < 1777903262 | 1777903262 |
| Red Hat Discovery 2 1778156756 | earliest → < 1778156756 | 1778156756 |
| Red Hat OpenShift AI 2.25 1780467147 | earliest → < 1780467147 | 1780467147 |
| Red Hat OpenShift AI 3.3 1778666987 | earliest → < 1778666987 | 1778666987 |
| Red Hat OpenShift Dev Spaces 3.27 1776795511 | earliest → < 1776795511 | 1776795511 |
| Red Hat OpenShift Service Mesh 2.6 1776191302 | earliest → < 1776191302 | 1776191302 |
| Red Hat OpenShift Service Mesh 3.0 1776151272 | earliest → < 1776151272 | 1776151272 |
| Red Hat OpenShift Service Mesh 3.1 1776151270 | earliest → < 1776151270 | 1776151270 |
| Red Hat OpenShift Service Mesh 3.2 1776149682 | earliest → < 1776149682 | 1776149682 |
| Red Hat OpenShift Service Mesh 3.3 1776151277 | earliest → < 1776151277 | 1776151277 |
| Red Hat Quay 3.12 1779811412 | earliest → < 1779811412 | 1779811412 |
| Red Hat Quay 3.14 1779689392 | earliest → < 1779689392 | 1779689392 |
| Red Hat Quay 3.15 1780891395 | earliest → < 1780891395 | 1780891395 |
| Red Hat Quay 3.16 1779204086 | earliest → < 1779204086 | 1779204086 |
| Red Hat Quay 3.17 1779922205 | earliest → < 1779922205 | 1779922205 |
| Red Hat Quay 3.1 1779822261 | earliest → < 1779822261 | 1779822261 |
| Red Hat Quay 3.9 1779811473 | earliest → < 1779811473 | 1779811473 |
| Red Hat Trusted Artifact Signer 1.3 1779971506 | earliest → < 1779971506 | 1779971506 |
| Streams for Apache Kafka 3.2.0 | Versions not published | |
| multicluster engine for Kubernetes 2.6 1778511348 | earliest → < 1778511348 | 1778511348 |
| multicluster engine for Kubernetes 2.8 1778383863 | earliest → < 1778383863 | 1778383863 |
| Gatekeeper 3 | Versions not published | |
| Migration Toolkit for Applications 8 | Versions not published | |
| Migration Toolkit for Containers | Versions not published | |
| Multicluster Engine for Kubernetes | Versions not published | |
| Network Observability Operator | Versions not published | |
| OpenShift Pipelines | Versions not published | |
| OpenShift Service Mesh 2 | Versions not published | |
| OpenShift Service Mesh 3 | Versions not published | |
| Red Hat 3scale API Management Platform 2 | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat build of Apache Camel - HawtIO 4 | Versions not published | |
| Red Hat build of Apicurio Registry 2 | Versions not published | |
| Red Hat build of Apicurio Registry 3 | Versions not published | |
| Red Hat Developer Hub | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenShift Virtualization 4 | Versions not published | |
| Red Hat Quay 3 | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Red Hat Trusted Profile Analyzer | Versions not published | |
| Self-service automation portal 2 | Versions not published | |
| Cryostat 4 | Versions not published | |
| Red Hat Build of Kueue | Versions not published | |
| Red Hat Data Grid 8 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Process Automation 7 | Versions not published | |
| streams for Apache Kafka 2 | Versions not published | |
| Red Hat Quay 3.10 1779822261 | earliest → < 1779822261 | 1779822261 |
| Red Hat Advanced Cluster Management for Kubernetes 2.14 1783451729 | earliest → < 1783451729 | 1783451729 |
| Red Hat OpenShift Service Mesh 3 1776151272 | earliest → < 1776151272 | 1776151272 |
| Red Hat Advanced Cluster Security 4.9 1779371594 | earliest → < 1779371594 | 1779371594 |
| Red Hat Migration Toolkit 1.8 1783690532 | earliest → < 1783690532 | 1783690532 |
| Network Observability (NETOBSERV) 1.11.1 1778510461 | earliest → < 1778510461 | 1778510461 |
| Network Observability (NETOBSERV) 1.11.0 1778510461 | earliest → < 1778510461 | 1778510461 |
| Red Hat Migration Toolkit for Containers 1.8 1783690532 | earliest → < 1783690532 | 1783690532 |
| Cluster Observability Operator 1.5.2 1781116667 | earliest → < 1781116667 | 1781116667 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- datatracker.ietf.org datatracker.ietf.org
- datatracker.ietf.org datatracker.ietf.org
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of axios
The 53 CVEs of axios →
CVE-2026-101899
Axios is a promise-based HTTP client for the browser and Node.js
6.9
Medium
CVE-2026-101909
Axios is a promise-based HTTP client for the browser and Node.js
8.3
High
CVE-2026-101908
Axios is a promise-based HTTP client for the browser and Node.js
6.9
Medium
CVE-2026-101907
Axios is a promise-based HTTP client for the browser and Node.js
7.0
High