CVE-2026-67315

CVE-2026-67315 in axios exposes a proxy bypass through mishandling of 0.0.0.0 as a destination address. The shouldBypassProxy logic correctly excludes 127.0.0.1 from proxy tunneling, but treats 0.0.0.0 as a non-loopback address—meaning requests to 0.0.0.0 still route through configured proxies. This is wrong: 0.0.0.0 resolves to localhost on most systems, so an attacker who can control the destination URL can force requests through the proxy while evading NO_PROXY exclusions intended to keep local traffic direct. The practical impact is more severe than a typical proxy bypass. When developers configure NO_PROXY=localhost, they're explicitly telling axios to bypass corporate proxies for local traffic—often because they assume direct connections won't be logged, inspected, or intercepted. The axios bypass defeats this: a URL injection vulnerability now lets an attacker reach internal services through the proxy, exposing authentication tokens, session cookies, and API responses to whatever middlebox sits between the application and its proxy. This is a threat model escalation, not just a reachability fix. You should verify whether your axios version falls in the affected ranges (0.31.0–0.33.0 or 1.15.0–1.18.0) and upgrade. More importantly, audit your application for URL injection points—any parameter, configuration, or user input that influences the destination of axios requests. This vulnerability only matters when an attacker can supply URLs, but URL injection is among the most common bug classes in applications making HTTP calls. The EPSS likely prices in this precondition; don't let the low exploitation probability create false confidence if your attack surface already includes URL handling that hasn't been scrutinized. The 0.0.0.0 ambiguity reflects a semantic gap present across HTTP client libraries. Node.js net.isIP() returns 0 for 0.0.0.0, creating an implicit mental model that treats it as "no specific address" rather than loopback. Other HTTP clients likely implement similar bypass logic with the same assumption. Treat this CVE as a signal to audit proxy exclusion logic across your entire request stack, not just axios.

Reviewed through automated stages and approved by a human before publication.