CVE-2026-67315 MEDIUM

CVE-2026-67315: axios 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0

Vendor Axios
Product axios
Weakness CWE-183
Published August 1, 2026
Last update August 1, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N

What the vulnerability does

01Description

axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.

Key dates

02Disclosure timeline

August 1, 2026 CVE published