CVE-2026-67315: Axios NO_PROXY Bypass For 0.0.0.0 Local Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f4gw-2p7v-4548",
  "modified" : "2026-09-01T18:39:43Z",
  "published" : "2026-07-20T22:20:18Z",
  "aliases" : [ "CVE-2026-67315" ],
  "summary" : "Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios",
  "details" : "## Summary\n\nAxios versions containing `lib/helpers/shouldBypassProxy.js` do not treat `0.0.0.0` as a local address when evaluating `NO_PROXY` rules. In Node.js applications that use `HTTP_PROXY` or `HTTPS_PROXY` together with `NO_PROXY=localhost,127.0.0.1,::1` or similar, a request to `http://0.0.0.0:<port>/` can be routed through the configured proxy instead of bypassing it.\n\nThe issue is exploitable when an attacker can influence the axios request URL or a followed redirect target, and when the proxy can reach or relay `0.0.0.0` to local services. This is a Node.js runtime proxy-routing issue, not a browser, install-time, or development-tooling issue.\n\n## Impact\n\nApplications are affected when all of the following are true:\n\n- The application runs axios in Node.js with the HTTP adapter.\n- The process uses environment proxy variables such as `HTTP_PROXY` or `HTTPS_PROXY`.\n- The process uses `NO_PROXY` entries such as `localhost`, `127.0.0.1`, or `::1` to keep local traffic out of the proxy path.\n- Attacker-controlled input can influence the request URL or redirect target.\n- The configured proxy does not reject `0.0.0.0` and can reach the local destination.\n\nFor plain HTTP targets, the proxy can receive the full request URL, headers, and body, and may be able to observe the local service response. HTTPS targets are less exposed because axios uses CONNECT tunneling in current versions.\n\n## Affected Functionality\n\nAffected functionality is limited to environment-derived proxy selection in the Node HTTP adapter:\n\n- `lib/adapters/http.js` calls `getProxyForUrl(location)` and then `shouldBypassProxy(location)` before applying the proxy.\n- `lib/helpers/shouldBypassProxy.js` normalizes and compares `NO_PROXY` entries.\n- Explicit caller-provided `config.proxy` remains trusted caller configuration.\n- Browser, React Native, XHR, and fetch adapter behavior are not affected.\n\n## Technical Details\n\n`lib/helpers/shouldBypassProxy.js` defines local loopback equivalence through `isLoopback()`. The current implementation recognizes `localhost`, IPv4 `127.0.0.0/8`, IPv6 `::1`, and IPv4-mapped loopback forms, but it does not include `0.0.0.0`.\n\nAt `lib/helpers/shouldBypassProxy.js:176`, axios treats two hosts as matching when both are considered loopback:\n\n```js\nreturn hostname === entryHost || (isLoopback(hostname) && isLoopback(entryHost));\n```\n\nBecause `isLoopback('0.0.0.0')` returns `false`, `NO_PROXY=localhost,127.0.0.1,::1` does not match `http://0.0.0.0:<port>/`. `lib/adapters/http.js:185-193` then applies the environment proxy.\n\n## Proof of Concept of Attack\n\n```js\nimport http from 'http';\nimport axios from './index.js';\n\nconst listen = (handler, host = '127.0.0.1') =>\n  new Promise((resolve) => {\n    const server = http.createServer(handler);\n    server.listen(0, host, () => resolve(server));\n  });\n\nconst close = (server) => new Promise((resolve) => server.close(resolve));\n\nconst origin = await listen((req, res) => res.end('origin'), '0.0.0.0');\n\nlet proxyRequests = 0;\nconst proxy = await listen((req, res) => {\n  proxyRequests += 1;\n  res.end('proxied');\n});\n\nprocess.env.http_proxy = `http://127.0.0.1:${proxy.address().port}`;\nprocess.env.HTTP_PROXY = process.env.http_proxy;\nprocess.env.no_proxy = 'localhost,127.0.0.1,::1';\nprocess.env.NO_PROXY = process.env.no_proxy;\n\ntry {\n  const direct = await axios.get(`http://127.0.0.1:${origin.address().port}/`);\n  const zero = await axios.get(`http://0.0.0.0:${origin.address().port}/`);\n\n  console.log({ direct: direct.data, zero: zero.data, proxyRequests });\n} finally {\n  await close(origin);\n  await close(proxy);\n}\n```\n\nExpected safe behavior: both `127.0.0.1` and `0.0.0.0` bypass the proxy when the `NO_PROXY` policy is intended to cover local destinations.\n\nObserved behavior: `127.0.0.1` bypasses the proxy, while `0.0.0.0` is sent through the proxy.\n\n## Workarounds\n\n- Add `0.0.0.0` explicitly to `NO_PROXY` where local addresses must bypass proxies.\n- Reject or normalize `0.0.0.0` in application URL validation before calling axios.\n- Set `proxy: false` on axios requests that must never use environment proxies.\n- Configure the proxy itself to reject `0.0.0.0`, loopback, link-local, and internal address ranges.\n\n<details>\n<summary>Original Report</summary>\n\n### Summary\n`axios` versions 1.15.0–1.16.1 contain an incomplete loopback-address check in `lib/helpers/shouldBypassProxy.js`. The `isLoopback()` function correctly identifies `127.0.0.0/8` and `::1` as loopback addresses but does not recognise `0.0.0.0` — the IPv4 unspecified address, which routes to the local machine on Linux and macOS.\n\nAn attacker who controls a URL passed to axios can use `http://0.0.0.0/<path>` to bypass proxy-based SSRF filtering that the application relies upon.\n\n### Details\n## Affected versions\n\n`>= 1.15.0, <= 1.16.1`\n\nThe vulnerability was introduced in v1.15.0 when the `shouldBypassProxy` helper was added as a security improvement (PR #10661).\n\n---\n\n## Root cause\n\n**File:** `lib/helpers/shouldBypassProxy.js`\n\n```javascript\n// Line 1 — static allowlist (incomplete)\nconst LOOPBACK_HOSTNAMES = new Set(['localhost']);   // ← 0.0.0.0 missing\n\nconst isIPv4Loopback = (host) => {\n  const parts = host.split('.');\n  if (parts.length !== 4) return false;\n  if (parts[0] !== '127') return false;   // ← 0.0.0.0: parts[0] = '0' → false\n  return parts.every((p) => /^\\d+$/.test(p) && Number(p) >= 0 && Number(p) <= 255);\n};\n\nconst isLoopback = (host) => {\n  if (!host) return false;\n  if (LOOPBACK_HOSTNAMES.has(host)) return true;   // ← '0.0.0.0' not in set\n  if (isIPv4Loopback(host)) return true;           // ← returns false for 0.0.0.0\n  return isIPv6Loopback(host);\n};\n\nisLoopback('0.0.0.0') returns false.\n\nNode's WHATWG URL parser does not normalise 0.0.0.0 to 127.0.0.1. Other bypass forms are safe: new URL('http://0177.0.0.1/').hostname → '127.0.0.1' (octal), new URL('http://2130706433/').hostname → '127.0.0.1' (decimal), new URL('http://0x7f000001/').hostname → '127.0.0.1' (hex). Only 0.0.0.0 escapes normalisation.\n\n\n### PoC\n'use strict';\n\n// Verbatim copy of relevant logic from axios v1.16.1 shouldBypassProxy.js\n\nconst LOOPBACK_HOSTNAMES = new Set(['localhost']);\n\nconst isIPv4Loopback = (host) => {\n  const parts = host.split('.');\n  if (parts.length !== 4) return false;\n  if (parts[0] !== '127') return false;\n  return parts.every((p) => /^\\d+$/.test(p) && Number(p) >= 0 && Number(p) <= 255);\n};\n\nconst isLoopback = (host) => {\n  if (!host) return false;\n  if (LOOPBACK_HOSTNAMES.has(host)) return true;\n  return isIPv4Loopback(host);\n};\n\n// 1. Show URL parser does NOT normalise 0.0.0.0\nconsole.log(new URL('http://0.0.0.0/').hostname);    // → '0.0.0.0'   ← NOT normalised\nconsole.log(new URL('http://0177.0.0.1/').hostname); // → '127.0.0.1' ← normalised (safe)\nconsole.log(new URL('http://2130706433/').hostname);  // → '127.0.0.1' ← normalised (safe)\n\n// 2. Show isLoopback fails for 0.0.0.0\nconsole.log(isLoopback('0.0.0.0'));   // → false  ← BUG: should be true\nconsole.log(isLoopback('127.0.0.1')); // → true   ← correct\n\nVerified output on Node.js v22 / axios v1.16.1:\n0.0.0.0     ← NOT normalised by URL parser\n127.0.0.1   ← octal normalised correctly\n127.0.0.1   ← decimal normalised correctly\nfalse       ← 0.0.0.0 not detected as loopback  ⚠\ntrue        ← 127.0.0.1 correctly detected\n\n### Impact\nApplications that:\n\nAccept user-supplied URLs and pass them to axios\nUse a proxy with NO_PROXY=localhost (or similar) for SSRF filtering\n…can be bypassed by supplying http://0.0.0.0/<path>. Axios routes the request through the proxy (shouldBypassProxy returns false). If the proxy itself does not filter 0.0.0.0, the connection reaches the local machine — exposing internal services such as cloud IMDS endpoints, internal admin panels, or microservice APIs.\n\nFix\nMinimal (one line):\n\n- const LOOPBACK_HOSTNAMES = new Set(['localhost']);\n+ const LOOPBACK_HOSTNAMES = new Set(['localhost', '0.0.0.0']);\n\nComprehensive:\n\nconst isIPv4Unspecified = (host) => host === '0.0.0.0';\n\nconst isLoopback = (host) => {\n  if (!host) return false;\n  if (LOOPBACK_HOSTNAMES.has(host)) return true;\n  if (isIPv4Loopback(host)) return true;\n  if (isIPv4Unspecified(host)) return true;   // add this line\n  return isIPv6Loopback(host);\n};\n</details>",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "axios"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.15.0"
      }, {
        "fixed" : "1.18.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "axios"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.31.0"
      }, {
        "fixed" : "0.33.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-67315"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-68946"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/axios/axios/pull/11000"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/axios/axios/pull/11001"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/axios/axios"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/axios/axios/releases/tag/v0.33.0"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/axios/axios/releases/tag/v1.18.0"
  }, {
    "type" : "WEB",
    "url" : "https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-183", "CWE-918" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-20T22:20:18Z",
    "nvd_published_at" : "2026-08-06T22:18:25Z"
  }
}