Permissive List of Allowed Inputs in axios - CVE-2026-67315

Vulnerability details

The vulnerability allows a remote attacker to perform server-side request forgery against local services through a configured proxy.

The vulnerability exists due to permissive list of allowed inputs in lib/helpers/shouldBypassProxy.js when evaluating NO_PROXY rules for requests to 0.0.0.0 in the Node.js HTTP adapter. A remote attacker can supply a crafted request URL or redirect target to perform server-side request forgery against local services through a configured proxy.

Exploitation requires axios to run in Node.js with environment proxy variables enabled, attacker-controlled input to influence the request URL or redirect target, and a proxy that can reach or relay 0.0.0.0 to local destinations.

Affected software

How to mitigate CVE-2026-67315

External References

• https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548

Related Security Bulletins

• Multiple vulnerabilities in axios
• Multiple vulnerabilities in IBM Watson Discovery Cartridge
• Multiple vulnerabilities in IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging