Description
Axios versions containing lib/helpers/shouldBypassProxy.js do not treat 0.0.0.0 as a local address when evaluating NO_PROXY rules. In Node.js applications that use HTTP_PROXY or HTTPS_PROXY together with NO_PROXY=localhost,127.0.0.1,::1 or similar, a request to http://0.0.0.0:<port>/ can be routed through the configured proxy instead of bypassing it.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
Affected version(s): **>= 0.31.0, < 0.33.0 >= 1.15.0, < 1.18.0** Patched version(s): **0.33.0 1.18.0**
References
Could your website be exposed too?
SmartScanner can check your website for Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios and gives you actionable findings to investigate.
Start a free scanRelated Issues
- axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CV - CVE-2026-44492
- Axios: no_proxy bypass via IP alias allows SSRF - CVE-2026-42038
- Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` - Vulnerability
- Axios: HTTP/2 streamed uploads bypass `maxBodyLength` - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated July 20, 2026