Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

Description

Axios versions containing lib/helpers/shouldBypassProxy.js do not treat 0.0.0.0 as a local address when evaluating NO_PROXY rules. In Node.js applications that use HTTP_PROXY or HTTPS_PROXY together with NO_PROXY=localhost,127.0.0.1,::1 or similar, a request to http://0.0.0.0:<port>/ can be routed through the configured proxy instead of bypassing it.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 0.31.0, < 0.33.0

  >= 1.15.0, < 1.18.0**

• Patched version(s): **0.33.0

  1.18.0**

References

• GHSA-f4gw-2p7v-4548
• CWE-183
• CWE-918
• OWASP 2021-A10
• OWASP 2021-A4

Related Issues

• axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CV - CVE-2026-44492
• Axios: no_proxy bypass via IP alias allows SSRF - CVE-2026-42038
• Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` - Vulnerability
• Axios: HTTP/2 streamed uploads bypass `maxBodyLength` - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

axios