CVE-2026-67315 axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-67315?
CVE-2026-67315 is a medium-severity vulnerability in axios, published on 1 Aug 2026.
Official description
axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.
Weakness: CWE-183
Which versions are affected by CVE-2026-67315?
4 open source packages ship an affected version, including axios. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
axios npm | From 0.31.0 | 0.33.0 |
axios npm | From 0.31.0 | 0.33.0 |
axios npm | From 1.15.0 | 1.18.0 |
axios npm | From 1.15.0 | 1.18.0 |
Products include Axios Axios.
How do I fix CVE-2026-67315?
Upgrade axios to a fixed version for your release line: 0.33.0 or 1.18.0.
Is CVE-2026-67315 being exploited?
There is no known exploitation of CVE-2026-67315 in the wild and no public exploit code.
Other vulnerabilities in axios
- CVE-2026-44494 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
- CVE-2026-44492 axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
- CVE-2026-67320 axios before 0.33.0 Prototype Pollution via Node HTTP adapter
- CVE-2026-44487 Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
- CVE-2025-27152 Possible SSRF and Credential Leakage via Absolute URL in axios Requests
Sources
Also known as CLEANSTART-2026-XM36205, CVE-2026-68946, DEBIAN-CVE-2026-67315, ECHO-dc66-a292-9d7e, GHSA-f4gw-2p7v-4548, MINI-3c6v-6x4v-xjhv and 18 more.