CVE-2025-62718

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 6.3EPSS 1%

Published 2026-04-09Updated 2026-04-16

Media 362

Vulnerability details

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0 and 0.31.0.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CNAGitHub_M

EPSS score history

Sources

4 links

PoC links are not available for guest users. Login to view them.

CVEShield CVE Organization RedHat Vuln DB NVD Analysis

Profile

CVSS

6.3

EPSS

Published

2026-04-09

Updated

2026-04-16

CNA

GitHub_M

Vendors

axios

1 product

CPEs

cpe:/a:redhat:ansible_automation_platform:2.5::el8

cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8

cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8

cpe:/a:redhat:ansible_automation_platform:2.5::el9

cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9

cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9

cpe:/a:redhat:cluster_observability_operator:1.5::el9

cpe:/a:redhat:network_observ_optr:1.11::el9

cpe:/a:redhat:advanced_cluster_security:4.10::el8

cpe:/a:redhat:advanced_cluster_security:4.9::el8

cpe:/a:redhat:ansible_automation_platform:2.6::el9

cpe:/a:redhat:rhdh:1.8::el9

cpe:/a:redhat:rhdh:1.9::el9

cpe:/a:redhat:discovery:2::el9

cpe:/a:redhat:openshift_ai:2.25::el9

cpe:/a:redhat:openshift_ai:3.3::el9

cpe:/a:redhat:openshift_devspaces:3.27::el9

cpe:/a:redhat:service_mesh:2.6::el8

cpe:/a:redhat:service_mesh:3.0::el9

cpe:/a:redhat:service_mesh:3.1::el9

cpe:/a:redhat:service_mesh:3.2::el9

cpe:/a:redhat:service_mesh:3.3::el9

cpe:/a:redhat:quay:3.12::el8

cpe:/a:redhat:quay:3.14::el8

cpe:/a:redhat:quay:3.15::el8

cpe:/a:redhat:quay:3.16::el9

cpe:/a:redhat:quay:3.17::el9

cpe:/a:redhat:quay:3.10::el8

cpe:/a:redhat:quay:3.9::el8

cpe:/a:redhat:trusted_artifact_signer:1.3::el9

cpe:/a:redhat:amq_streams:3.2::el9

cpe:/a:redhat:multicluster_engine:2.6::el9

cpe:/a:redhat:multicluster_engine:2.8::el9

cpe:/a:redhat:gatekeeper:3

cpe:/a:redhat:migration_toolkit_applications:8

cpe:/a:redhat:rhmt:1

cpe:/a:redhat:multicluster_engine

cpe:/a:redhat:network_observ_optr:1

cpe:/a:redhat:openshift_pipelines:1

cpe:/a:redhat:service_mesh:2

cpe:/a:redhat:service_mesh:3

cpe:/a:redhat:red_hat_3scale_amp:2

cpe:/a:redhat:acm:2

cpe:/a:redhat:ansible_automation_platform:2

cpe:/a:redhat:apache_camel_hawtio:4

cpe:/a:redhat:service_registry:2

cpe:/a:redhat:apicurio_registry:3

cpe:/a:redhat:rhdh:1

cpe:/a:redhat:enterprise_linux_ai:3

cpe:/a:redhat:jboss_fuse:7

cpe:/a:redhat:openshift_ai

cpe:/a:redhat:openshift:4

cpe:/a:redhat:container_native_virtualization:4

cpe:/a:redhat:quay:3

cpe:/a:redhat:satellite:6

cpe:/a:redhat:trusted_profile_analyzer:2

cpe:/a:redhat:ansible_portal:2

cpe:/a:redhat:cryostat:4

cpe:/a:redhat:kueue_operator:1

cpe:/a:redhat:jboss_data_grid:8

cpe:/o:redhat:enterprise_linux:8

cpe:/o:redhat:enterprise_linux:9

cpe:/a:redhat:jboss_enterprise_bpms_platform:7

cpe:/a:redhat:amq_streams:2

cpe:/a:redhat:acm:2.14::el9

cpe:/a:redhat:rhmt:1.8::el8

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated