axios up to 1.17.x Proxy Bypass shouldBypassProxy.js access control

Summaryinfo

A vulnerability classified as critical was found in axios up to 1.17.x. Impacted is an unknown function of the file shouldBypassProxy.js of the component Proxy Bypass. Such manipulation leads to access control. This vulnerability is referenced as CVE-2026-67315. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in axios up to 1.17.x. It has been rated as critical. Affected by this issue is an unknown function of the file shouldBypassProxy.js of the component Proxy Bypass. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-67315 since 07/29/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 1.18.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-51829). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• axios

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17

Website

• Product: https://github.com/axios/axios/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion